Xavi Amatriain, Expedia Group's Chief AI and Data Officer, stated that evaluations now serve as the primary product requirements document for AI systems. These evaluations, including red teaming, embed security requirements early in the design process. He believes AI-assisted code generation will enhance this approach, focusing all developmental thought on evaluations. Amatriain previously held significant AI roles at Google before joining Expedia.VentureBeat research highlights a significant trust gap in automated evaluations, with many enterprises deploying AI without full confidence in these systems. A substantial number of AI agents have failed in real-world customer interactions despite passing internal evaluations. Amatriain argues that excessive guardrails can hinder feedback loops and bias learning processes, viewing them as a necessary but diminishing evil. Expedia's governance model layers principles, processes, and automation, with release toll gates calibrated to risk levels.Amatriain advocates for specialized agents composed into larger systems rather than monolithic AI, finding this approach more secure and manageable. Expedia's architecture builds from components to skills, sub-agents, and ultimately, orchestrated agentic systems. He emphasizes that systemic design, rather than a specific model, is crucial for effective AI development. Narrowly scoping agents facilitates isolated evaluation and lockdown before integration.Expedia uses retrieval-augmented generation and direct API calls based on latency needs, ensuring immediate responses for cached information and more complex reasoning for real-time data. Unlike generic chatbots, Expedia cross-references supplier claims with its own review data. Crucially, the user retains the final click for bookings, a non-negotiable security decision protecting against unauthorized actions. Amatriain stresses that security must be integrated from the design phase, minimizing the need for post-hoc guardrails.He foresees AI systems increasingly being threatened by other powerful AI agents, making rapid detection and remediation essential. A continuous feedback loop from operational AI systems into evaluation is critical for swift fixes. Expedia's risk-calibrated governance aims to stay ahead of this feedback loop, acknowledging the increasing threat landscape and the necessity of robust security measures.