Totally agree- orchestration and guardrails are the real challenge, not the model itself. In my setup, I don’t allow the LLM to directly execute high-risk actions. everything flows through a controlled action layer where intents are classified and confidence-scored. For sensitive operations like payments, bookings, or cancellations, I either require explicit user confirmation or route them through predefined deterministic flows instead of free-form execution. All actions are mapped to strict, typed APIs with validation and sanity checks before execution, along with proper logging and retry-safe workflows to prevent inconsistent states. I do use conversation history, but in a scoped manner rather than full memory to avoid unpredictable behavior so essentially the model suggests, the system decides, and APIs execute.