AI Engineering Playbook¶

A free, open-source guide to the AI engineering skills that matter in 2027, from your first LLM API call to building AI agents and securing them in production. Written for beginners to intermediates, with the focus on understanding: short plain-language notes on coding agents, LangGraph agents, guardrails, LLM security (OWASP LLM Top 10), evals, agent memory and AI system design, with diagrams, self-checks, carefully chosen sources, and five hands-on projects.

Tip

New here? Take the two-minute self-check in START-HERE.md to find your starting module.

Why this playbook¶

Building an AI agent is no longer the hard part. Coding agents write most of the code, and frameworks give you the agent loop. What companies now need are engineers who can make AI systems safe, secure, measurable and reliable: people who know how agents get attacked, how to prove an answer is right, and how to keep costs and failures under control. This playbook is built around that shift.

Learning path¶

flowchart LR
  F[00 Foundations] --> CA[01 Coding agents]
  CA --> BA[02 Building agents]
  BA --> S[03 Safety and guardrails]
  BA --> SEC[04 LLM security]
  S --> EV[05 Evaluation]
  SEC --> EV
  BA --> MEM[06 Agent memory]
  EV --> OPS[07 Agent ops]
  MEM --> OPS
  OPS --> SD[08 System design]
  SD --> C[09 Careers 2027]

Modules¶

#	Module	You'll be able to	Project
00	Foundations	Explain LLMs, tokens, embeddings and RAG; call a model from code
01	Coding agents	Direct a coding agent with `AGENTS.md`, skills, MCP and a spec-to-review workflow	P1
02	Building agents	Build LangGraph agents with tools, checkpoints and human approval	P3
03	AI safety and guardrails	Design input, output and action guardrails; handle PII; use a gateway	P4
04	LLM security	Explain and defend against every OWASP LLM Top 10 (2026) and agentic risk	P2
05	Evaluation	Build eval sets, LLM judges and red-team scans	P3, P4
06	Agent memory	Design memory that resists poisoning and respects privacy	P3
07	Agent ops and production	Trace, cost, load-test and deploy AI services	P5
08	AI system design	Design, threat-model and check compliance for real systems	P5
09	Careers in 2027	Map skills to roles, build a portfolio, follow a 90-day plan

Projects¶

Every project runs and passes its tests without an API key, using fake models. Add a free Gemini key (or any provider via LiteLLM) to try it with a real model.

Project	What you build	Tests
P1 · Agent-built CLI	A real tool built with a coding agent: spec, `AGENTS.md`, a skill, tests first, and a reflection on what the agent got wrong	20
P2 · Secure RAG assistant	A RAG app you attack five ways (cross-tenant leaks, injection, XSS, prompt extraction, cost), then defend	26 + 5 expected failures
P3 · LangGraph research agent	A multi-step agent with read-only tools, checkpoints, human-approved long-term memory and evals	11
P4 · Guardrailed support agent	A support agent with every guardrail layer, Indian PII masking, rate limits, budgets and an LLM-judge eval suite	33
P5 · Production capstone	P4 in production: OpenTelemetry traces, cost metrics, load test, Docker, design doc and threat model	5

How every note works¶

Each concept note follows the same shape, so you always know where to look: in one sentence, why it matters in 2027, an everyday analogy, how it works, an example, common mistakes, three self-check questions (answers hidden), and two to four sources tagged by level, format and time. Terms are defined in the glossary.

Contributing¶

Corrections, clearer explanations and new topics are welcome. Read CONTRIBUTING.md and STYLE.md, and see PROGRESS.md for what's being worked on. Please follow the Code of Conduct.

License¶

Written content is licensed under CC BY-SA 4.0. Project code is licensed under MIT.

An open-education initiative by NeuralSaas AI. Free forever. About this project.

Learn to build AI systems that are safe, secure and reliable.