Enterprise AIAI gatewayPrompt cachingModel routingCost model

The RAI Pipeline: enterprise AI value comes from the control layers, not the model

Everyone competes on model quality, but enterprise adoption is decided by the layers around the model. We formalize a five-stage pipeline, authorization, DLP, RAG, routing and caching, audit, as one composed function, then price its cost layer at 2026 rates. A representative RAG request drops 65.9%, from $0.0225 to $0.0077, and routing alone (46.7%) reproduces the field-observed 47% unit-cost drop. The saving is fully set by two levers we publish in full. Value reads as a product, safety times accuracy times economy times controllability, so any zeroed layer zeroes the whole. A model, not a measurement, with the interest disclosed.

There is a comfortable story that enterprise AI is a race on model quality, that whoever wires up the best model wins. It is mostly wrong. What decides adoption is not the model but the layers around it: who is allowed to ask, what leaves the building, whether the answer is grounded in company truth, what it costs, and who can audit it later. Install the best model with none of that and you get Shadow AI, secrets leaking to a provider on a personal account, cost you cannot see, answers from the model's general knowledge instead of your own documents.

-65.9%

per-request cost cut by the pipeline (representative RAG request)

46.7%

routing alone, matching the field-observed 47% unit-cost drop

5+1

pipeline layers; the sixth (output verification) is our proposed extension

The pipeline, written as a function

We take a pipeline that has been running in production and write it down as a composition, because the order is not arbitrary, it is load-bearing:

answer = audit( model( route·cache( RAG( DLP( authorize(request) ) ) ) ) )

Authorization must be first, so identity comes from the session and a prompt injection cannot cross tenants. DLP masking and RAG both sit before the model, one to keep PII from leaving, the other to pin the answer to company truth. Routing and caching happen at the model call, the cost layer. Audit must be last, capturing every query and cost. Read as a product, the value is safety times accuracy times economy times controllability, and any layer set to zero zeroes the whole. That is why a single copied feature does not reproduce the pipeline, and why the wrapper, not the model, is the moat.

The one layer that is measured in dollars

Four of the five layers are argued; one is priced. Using 2026 list rates, Claude Sonnet 4.6 at $3/$15 with cache reads at ten percent, Haiku 4.5 at $1/$5, a representative enterprise RAG request costs $0.0225 if you send everything to the frontier model with no caching. Prompt caching on the repeated system prefix takes it to $0.0144, a 36.0 percent cut. Routing only thirty percent of requests to the frontier and the rest to a cheaper tier takes it to $0.0077, a 65.9 percent reduction. Routing on its own is 46.7 percent, which lands almost exactly on the "47% unit-cost drop" observed in practice. The field claim of "up to 60% off" is not marketing inflation; under the representative assumptions it is if anything conservative.

Two levers, published in full

The reduction depends on exactly two numbers: the share of input that is cacheable (the repeated system prefix) and the share of requests routed to the frontier model. Both are knowable, from public prices and from an audit log. So we do not ship one headline; we ship the whole sensitivity grid, so a reader can find their own workload and read off their own saving.

Takeaway. Enterprise AI value is not the model, which is a swappable part, but the pipeline that authorizes, masks, grounds, routes, and audits around it. The cost layer alone reproduces the field's number from public prices, and the rest of the value, safety and grounding and governance, is what turns "install a tool" into "embed into the work."

The honest gap: the output side is empty

The pipeline defends the input side. DLP masks what goes in; nothing verifies what comes out. If the model leaks PII from context into its answer, or fabricates a citation, the current five layers do not catch it. We propose a sixth, output verification, output DLP plus citation checking, the same conclusion our completion-illusion and self-preference studies keep reaching: do not trust the model's self-report, verify at the system layer. The two remaining assumptions, cacheable share and routing mix, are exactly what an audit log measures, which is how this model becomes a measurement.

GitHub (run it)Paper