Specifically curious about ecommerce because the patterns are different from B2B.

What we're hearing:

Working on a governance framework we want to publish openly. Want input from teams actually shipping under governance constraints.

What we've drafted as the priority list:

Enterprise security review is where most AI deployments stall. Sharing the checklist we now use to pass on first pass.

Pre-review checklist:

- SOC 2 Type II report ready

Tried flat multi-agent setups, didn't scale. Tried hierarchical with strict roles, too rigid. Settled on supervisor pattern with dynamic delegation.

How it works:

- Supervisor agent receives the task, decomposes it

Specific story because the lesson generalised.

Mid-deployment with a regional bank. Three weeks before go-live. Their compliance lead asked one question: 'If the model logs a customer's PII into its training data via prompt feedback, are we in violation of GDPR?'

Specific because we lived this.

We had an agent that recursively called itself based on input length. One weekend, an edge case triggered the recursion. By Monday, we'd burned through a month's token budget.

Skipping the marketing version, here's how it actually works in our production deployments.

Routing logic:

- Task classification at agent input: reasoning-heavy, retrieval-heavy, generation-heavy, or sensitive

BYOM gets thrown around as a buzzword. For air-gapped deployments, it's specific engineering.

What we actually do:

Connector roadmap conversation, want community input.

Top requests we keep hearing:

- SAP S/4HANA deep integration (not just API calls)

Most PII masking ships at the response layer. The compliance gap is real.

Why prompt-layer masking matters:

- Customer support agents often receive raw PII in inbound messages