Capability gets a pilot; cost discipline and governance get a deployment. This module covers token economics and the four levers that cut spend, what an AI usage policy contains, client-data and IP rules, responsible-AI habits, and a checklist tying all eight modules together.
The first seven modules made you capable: you can prompt, verify, call APIs, ground models in your data, measure quality, and operate agents. This final Common Core module makes you deployable — because in a real organization, the questions that decide whether your AI work ships are rarely "does it work?" alone. They are: what does it cost at scale, and who approved this data going where, and can we say this to a client, and who owns the output? Professionals who can answer those questions get to run AI initiatives; professionals who can't get run by them.
Cost and governance also happen to be where the ten universal employer expectations from our research close the loop: cost/latency/token management and responsible AI are the last two on the list, and they show up in postings from platform engineering ("LLM cost observability") to leadership ("own the usage policy") to every services-company role that touches client data.
Capability gets a pilot; cost discipline and governance get a deployment. The professional habit is to treat "what does this cost per month?" and "what data is leaving, to whom, under what agreement?" as design inputs — asked at the whiteboard, not discovered in the invoice or the incident review.
Module 4 introduced tokens as the billing unit; here is the recap that matters for money. Every API call bills input tokens (everything you send: system prompt, history, retrieved context, the user's text) and output tokens (everything generated), with output priced several times higher than input. A rough working conversion: one token ≈ ¾ of an English word, so a 1,000-word document is ~1,300 tokens.
Providers price per million tokens (MTok) in capability tiers. As of July 2026, Anthropic's published API prices illustrate the shape (OpenAI and Google publish comparable tiered pricing; check current pages before you budget — these numbers move):
| Tier (example: Claude, July 2026) | Input / MTok | Output / MTok | Typical use |
|---|---|---|---|
| Small, fast (Haiku 4.5) | $1.00 | $5.00 | Classification, extraction, routing, high-volume drafts |
| Mid-tier (Sonnet 4.6) | $3.00 | $15.00 | Most production workloads: summarization, RAG answers, coding |
| Frontier (Opus 4.8) | $5.00 | $25.00 | Hard reasoning, long-horizon agents, final-pass quality |
Three consequences follow directly from the table:
Latency roughly tracks cost: smaller models respond faster. When you tier for cost you usually improve user experience too — a double win that makes tiering the first lever to reach for.
You don't need to be the platform team to control AI spend. Four levers sit in every practitioner's hands.
Route each task to the cheapest model that passes your eval. The professional pattern is a cascade: the small model handles everything by default; cases it flags as hard (or fails on) escalate to the mid-tier; the frontier model is reserved for the few tasks where evals show it's genuinely needed. Teams that tier typically run 70–90% of volume on the cheapest tier. The eval is what makes this safe — "cheapest model that passes the bar" is an empirical fact, not a hope.
Providers offer prompt caching: mark the stable prefix of your request (system prompt, tool definitions, a large shared document), and repeat requests read it at a deep discount — on Anthropic's API, cached reads bill at roughly one-tenth the input rate; other providers offer similar mechanics. The craft is structure: stable content first and byte-identical across calls, volatile content (timestamps, user questions) last. A timestamp interpolated into your system prompt silently disables caching for everything after it.
Everything you send bills, every call, forever. Common flab: pasting whole documents where a relevant section suffices (Module 5's retrieval mindset applies), letting chat history grow unbounded instead of summarizing it, verbose few-shot examples that a tightened instruction could replace, and — the classic — instructions like "be concise" buried in a 2,000-token preamble. Auditing a prompt for length once saves money on every call thereafter; it's the highest-leverage code review you can do on an AI feature.
For anything that doesn't need an interactive answer — nightly reports, backfills, bulk classification — providers offer batch APIs at 50% off in exchange for asynchronous processing (typically within hours). Half price for changing when, not what. If a workload runs on a schedule, batching it is close to free money.
Apply the levers in order of effort: tiering (one config change per route) → batching (for scheduled work) → caching (restructure prompts once) → length discipline (ongoing habit). Teams applying all four routinely land at 5–10x below their naive first bill.
The workflow: your support team wants every incoming ticket summarized and tagged with category and urgency before an agent picks it up. Volume: 500 tickets per weekday, 22 working days per month.
Per-ticket tokens: system prompt with instructions and tag taxonomy ≈ 500 tokens; average ticket thread ≈ 2,000 tokens; output (summary + tags) ≈ 200 tokens. So ~2,500 input and 200 output tokens per ticket.
Step 0 — naive baseline (everything on mid-tier, $3/$15 as of July 2026):
Already cheap in absolute terms — that's the honest first observation, and it's why the interesting version of this exercise is the shape of the math, which survives when your volumes are 100x larger or your inputs are 50-page documents.
Step 1 — tier it. Your eval (built with Module 6 methods on 50 real tickets) shows the small tier ($1/$5) passes the bar on routine tickets but fails on long multi-issue threads — about 20% of volume. Route 80% small, 20% mid:
Step 2 — cache the stable prefix. The 500-token system prompt is identical on every call. Cached, those reads bill at ~one-tenth rate; on this workflow's blend that trims roughly $0.20/day — ~$49/month. Modest here because the prompt is small relative to the ticket; on RAG workflows with big shared context, caching is often the largest lever.
Step 3 — batch what isn't urgent. Tickets arriving overnight (say 30% of volume) don't need real-time treatment; a 7 a.m. batch run at 50% off trims another ~15%: ~$42/month, roughly a third of the naive baseline — with a written eval justifying every routing decision.
Now scale the shape: the same arithmetic at 50,000 tickets/day is $11,500/month naive versus ~$4,200 tiered-cached-batched — a difference that pays for the engineer doing the tiering. And the agent caveat from earlier applies in reverse: if this were a 15-step agent per ticket instead of one call, multiply the baseline by roughly the step count before applying the levers.
Always date your cost estimates ("at July 2026 prices") and link the pricing page in the estimate. Per-token prices have fallen repeatedly and will again; a stale number in a business case, in either direction, damages exactly the credibility this module is meant to build.
Every serious organization now has (or urgently needs) an AI usage policy, and our research found ownership of it landing on engineering leadership as often as on legal. As the practitioner, you need to know what policies cover and how to operate inside one.
What a typical policy covers:
If no policy exists, that's an opportunity, not a free-for-all. The questions to ask — of your manager, IT, or legal — double as the outline of the policy you may end up drafting:
Asking these questions marks you as the person who can be trusted with AI, which is precisely the reputation this track is designed to build.
The single most damaging governance failure in practice is mundane: confidential or client data pasted into a personal-account consumer tool. It can breach contract and law simultaneously, and it is invisible until it isn't. When in doubt: sanctioned tool, enterprise account, minimum necessary data — or don't paste.
For the large share of Indian IT professionals working in services companies, this section is the one that touches contracts. The services reality: the data is not yours. It's the client's, governed by an MSA that predates modern AI tools and likely says nothing explicit about them — which means silence is not permission. Using an AI service on client data typically makes that provider a subprocessor in contract terms, and subprocessors usually require client notification or consent.
The safe operating posture: assume client data may not enter any AI tool until someone who has read the contract says otherwise, and prefer client-approved environments (their tenant, their region, their tools) when they exist. Many client engagements now include AI-usage clauses going both directions — some mandate AI-assisted delivery, some prohibit it; know which one you're on.
The regulatory floor, honestly and briefly. Two regimes matter most for this audience:
The honest summary a working professional needs: you are not expected to be a lawyer; you are expected to recognize personal and client data when you see it, strip or mask what the task doesn't need (a stack trace rarely needs the customer's email address in it), use only sanctioned tools for it, and escalate rather than improvise when a contract question appears. That behavior, consistently applied, is most of compliance.
Who owns AI-assisted work product? The practical answers, with the honest caveat that law here is still settling and jurisdiction-dependent:
Frameworks like the NIST AI Risk Management Framework and ISO/IEC 42001 (the AI management-system standard your security and compliance colleagues increasingly certify against) exist for organizational governance — you met them in the employer research, and role tracks go deeper. At the individual practitioner level, responsible AI reduces to three daily habits:
Assessment questions on this module favor scenario judgment over definitions. Expect the shape: "a colleague pastes a client's production data into a personal chatbot account to debug faster — what's wrong and what should happen next?" The strong answer names the data class, the account problem, the contract exposure, and the escalation path — not just "that's against policy."
Eight modules compressed into the habits that make someone trustworthy with AI at work. Before you rely on, ship, or scale anything AI-assisted, run the list:
Print it, or internalize it — either way, this list is the difference between "uses AI" on a resume and being the person a team trusts to put AI into anything that matters.
The Common Core gave every role the shared foundation; the leverage now is specialization. Pick your role track — Software Engineering, Data Engineering, DevOps/SRE, Security, QA, Product Management, and the rest — where these eight skills get applied to your actual daily work: the playbooks, the labs, and the role assessment that earns the Applied AI Professional credential for your discipline. The best next step is the track for the job you have; the second-best is the track for the job you want.