AI-Enabled Web Engineering

Introduction and Context

Artificial intelligence has moved from being an isolated analytical capability to becoming an integral part of web engineering. Modern web applications may use large language models (LLMs) to interpret user requests, retrieve enterprise knowledge, generate structured responses, personalise interfaces, produce test cases, detect anomalies, and assist software developers. These capabilities create substantial opportunities, but they also introduce new engineering responsibilities. An AI-enabled web application is not simply a conventional application with a chatbot added to it. It is a socio-technical system in which probabilistic models interact with deterministic software, data stores, users, organisational policies, and external service providers.

The central engineering challenge is therefore controlled integration. Systems must provide useful results while managing hallucination, latency, cost, privacy, bias, prompt injection, data leakage, model drift, and uncertain outputs. Reliability must be designed through retrieval, validation, observability, access control, testing, and human oversight rather than assumed from the apparent fluency of generated text.

This chapter examines the architecture and governance of AI-enabled web applications, with particular emphasis on retrieval-augmented generation, structured outputs, human-in-the-loop workflows, AI-assisted development, personalisation, testing, security, privacy, fairness, reliability, and operational economics.

Learning Objectives

After completing this chapter, a student should be able to:

1. Explain the architecture and operating principles of AI-enabled web applications.

2. Distinguish prompting, fine-tuning, retrieval-augmented generation, and tool use.

3. Design retrieval pipelines that preserve relevance, authority, and access control.

4. Apply schemas, validation, and human oversight to constrain model outputs.

5. Evaluate AI-assisted development, personalisation, and automated testing critically.

6. Identify security, privacy, bias, reliability, and regulatory risks.

7. Construct an operational cost and quality evaluation framework.

8. Recommend best practices for deploying and governing AI features.

1. Foundations of AI-Enabled Web Engineering

1.1 The probabilistic component in a deterministic system

Traditional web systems generally map inputs to outputs through explicitly programmed rules. AI components instead estimate likely outputs from statistical patterns. The same prompt can produce different responses, and a confident response can be incorrect. Consequently, the application must separate:

• Deterministic responsibilities: authentication, authorisation, payment processing, schema validation, database transactions, and audit logging.
• Probabilistic responsibilities: classification, summarisation, natural-language interaction, semantic search, recommendation, and content drafting.
• Governance responsibilities: approval, escalation, monitoring, data retention, and accountability.

A sound architecture does not allow a model to make unrestricted changes to critical state. The model may propose an action, but deterministic application logic should authenticate the requester, check permissions, validate parameters, apply business rules, and record the result.

1.2 Common integration patterns

Prompting provides instructions and contextual data at inference time. It is quick to implement and appropriate when the task depends mainly on general model capability.

Retrieval-augmented generation (RAG) retrieves relevant organisational or domain documents and supplies them as context to the model. It is useful when information is private, frequently changing, or too specialised to rely on model pretraining.

Fine-tuning modifies model parameters using task-specific examples. It can improve style, classification, or format consistency, but it does not automatically provide current facts and may increase data-governance risk.

Tool or function calling allows a model to request controlled operations, such as querying inventory or creating a draft ticket. The model should not directly receive unrestricted database or operating-system access.

Agents combine planning, model calls, retrieval, and tools over multiple steps. They may solve complex tasks, but their larger action surface increases cost, latency, and safety risks. Agent autonomy should therefore be proportional to the consequence of failure.

2. Reference Architecture

A practical AI-enabled web architecture commonly contains the following layers:

1. User interface: chat, search, recommendation, form assistance, or developer tool.

2. Application API: session management, rate limiting, request validation, and orchestration.

3. Policy and identity layer: authentication, authorisation, tenant isolation, and data-loss controls.

4. Context layer: retrieval, conversation state, user profile, and approved business data.

5. Model gateway: provider selection, prompt templates, timeout handling, retries, redaction, and usage metering.

6. Validation layer: schema validation, policy checks, citation verification, and business-rule enforcement.

7. Human review layer: approval, correction, escalation, and feedback capture.

8. Observability layer: traces, quality evaluations, cost, latency, refusal rates, and incidents.

A request should pass through an explicit pipeline rather than being concatenated into an unexamined prompt. A representative flow is:

`request → identity and policy checks → input moderation → retrieval and context filtering → model invocation → output parsing → schema and policy validation → human or automated action → audit and monitoring`.

The model gateway is especially valuable in professional systems because it prevents application code from becoming tightly coupled to one provider. It can implement model routing, fallback, token budgets, caching, and provider-specific adaptations.

3. Retrieval-Augmented Generation

3.1 Retrieval pipeline

A RAG system normally has two stages. During indexing, source documents are collected, cleaned, classified, divided into chunks, embedded as vectors, and stored with metadata. During querying, the user request is embedded, candidate passages are retrieved, optionally reranked, and inserted into a controlled context for generation.

Important metadata includes document owner, publication date, version, classification, tenant, access-control labels, and source URL. Metadata is not merely descriptive: it enables filtering before retrieval results are shown to a model.

Chunking requires judgment. Very small chunks lose context; very large chunks waste context capacity and reduce retrieval precision. Headings, paragraphs, tables, code blocks, and legal clauses should be treated according to their semantic structure rather than split solely by character count. Overlap can preserve continuity, but excessive overlap increases index size and duplicate evidence.

3.2 Retrieval quality

Two standard information-retrieval measures are precision and recall. For a set of retrieved results:

\[

\text{Precision} = \frac{\text{relevant retrieved items}}{\text{all retrieved items}}

\]

\[

\text{Recall} = \frac{\text{relevant retrieved items}}{\text{all relevant items in the collection}}

\]

Precision measures the proportion of retrieved material that is useful; recall measures how much of the relevant material was found. These measures require labelled relevance judgments and are meaningful only relative to a defined query set and relevance criterion. In production, retrieval evaluation should also consider ranking position, freshness, access-control correctness, and whether the final answer is supported by the retrieved evidence.

Vector similarity is useful for semantic matching but can miss exact identifiers, product codes, names, and negations. Hybrid retrieval combines lexical search with vector search. Reranking can then use a more expensive model to order a smaller candidate set. Retrieval quality must be evaluated separately from generation quality: a fluent answer cannot compensate for missing or unauthorised evidence.

3.3 Grounding and citations

A grounded generation prompt should instruct the model to answer only from supplied evidence when the task requires it, identify insufficient evidence, and cite source identifiers. Citation presence alone is not sufficient. The application should assess whether the cited passage actually supports the claim. For high-risk domains, claims may require deterministic verification or human approval.

A useful design principle is abstention by design. If retrieval confidence is low, sources conflict, or the question is outside scope, the system should state that it cannot reliably answer and direct the user to an appropriate alternative.

4. Structured Outputs and Controlled Actions

Free-form text is difficult to validate and unsafe to use directly in workflows. Structured output constrains a model to a schema such as JSON. A support classification, for example, might require:

```json

{

"category": "billing",

"priority": "medium",

"summary": "string",

"requires_human_review": true,

"evidence_ids": ["string"]

}

```

The schema should define required fields, allowed enumerations, length limits, and data types. Server-side validation remains essential because a model's apparent compliance does not replace application validation. Invalid output should trigger repair, retry with a bounded policy, or escalation—not silent acceptance.

Structured output is different from correctness. A model can produce valid JSON containing a false claim. Therefore, syntactic validation, semantic validation, source verification, and business-rule validation should be treated as separate controls.

For tool use, define a narrow contract. A `refund_order` operation might accept only an order identifier and an amount within a deterministic limit. The server must re-check ownership, refund eligibility, currency, and duplicate execution. Idempotency keys and transaction controls are necessary when model-generated actions can change state.

5. Human Oversight and Decision Design

Human oversight should be designed according to risk rather than added as a vague final step. Three useful patterns are:

• Human-in-the-loop: a person approves or edits an AI proposal before execution.
• Human-on-the-loop: the system acts within defined boundaries while a person monitors exceptions and can intervene.
• Human-in-command: the AI supplies analysis, but the person retains formal decision authority, as in high-impact employment, medical, or legal contexts.

Escalation criteria may include low retrieval confidence, sensitive personal data, conflicting sources, high monetary value, unusual user behaviour, safety-related content, or repeated model failure. The interface should reveal relevant evidence, uncertainty, and the reason for escalation. A reviewer who sees only a fluent recommendation cannot exercise meaningful oversight.

Feedback from reviewers should be categorised. A correction may indicate a retrieval problem, an ambiguous policy, a schema deficiency, a model limitation, or a user-interface problem. Treating every correction as training data can encode inconsistent or biased decisions.

6. AI-Assisted Development and Testing

AI coding assistants can generate boilerplate, explain unfamiliar code, draft tests, translate languages, and identify possible defects. Their productivity value depends on task type, developer expertise, review quality, and integration complexity. Generated code may contain insecure dependencies, incorrect assumptions, licensing concerns, or tests that merely reproduce the implementation rather than verify behaviour.

Professional use requires:

• repository and secret-boundary controls;
• human review by a competent developer;
• static analysis, dependency scanning, and automated tests;
• secure coding standards;
• provenance and licensing review where generated material is incorporated;
• measurement of defect escape rate and maintainability, not only lines of code produced.

AI can assist testing by generating unit cases, boundary values, accessibility checks, API contract tests, synthetic data, and exploratory test scenarios. However, generated tests may share the model's assumptions and miss requirements that were never expressed in the prompt. Mutation testing, property-based testing, independent test design, and production monitoring provide stronger evidence.

AI-enabled testing should also test the AI feature itself. A suitable evaluation set includes normal, ambiguous, adversarial, multilingual, sensitive, and out-of-distribution inputs. Regression suites should be versioned because changing a model, prompt, retrieval index, or safety policy can change behaviour without a conventional source-code change.

7. Personalisation and Recommendation

Personalisation can adapt content, navigation, search ranking, offers, accessibility settings, or educational explanations. It can use explicit preferences, session context, behavioural history, or inferred interests. The least intrusive data that achieves the objective should be preferred.

Personalisation creates a tension between relevance and autonomy. Excessive inference can produce a “filter bubble,” expose sensitive characteristics, or discriminate among users. Users should receive understandable explanations, meaningful controls, and an opportunity to correct important profile data. Personalisation should not be used to manipulate vulnerable users or make high-impact decisions without appropriate safeguards.

Evaluation should go beyond click-through rate. Useful measures include task completion, retention, complaint rate, diversity of exposure, calibration, subgroup performance, and long-term user value. A short-term increase in engagement may represent harmful or addictive optimisation rather than improved service.

8. Security and Privacy

AI systems enlarge the attack surface of a web application. Important threats include:

• Prompt injection: untrusted content attempts to override system instructions.
• Indirect prompt injection: malicious instructions are embedded in retrieved documents, web pages, or emails.
• Data exfiltration: prompts, retrieval context, or outputs reveal confidential information.
• Insecure tool use: the model requests unauthorised or dangerous operations.
• Model denial of service: costly or repetitive inputs consume resources.
• Training-data or feedback poisoning: manipulated data changes retrieval or evaluation behaviour.
• Cross-tenant leakage: one customer's data appears in another customer's context or response.

Prompt instructions are not a security boundary. Security boundaries must be enforced through identity, access-control checks, data filtering, network policy, and deterministic code. Retrieved documents should be treated as untrusted input even when they originate inside the organisation.

Privacy engineering should address purpose limitation, data minimisation, retention, deletion, access, encryption, and provider terms. Sensitive data should be redacted or tokenised where possible. Conversation logs require a defined retention purpose and access policy. Consent does not automatically make every secondary use appropriate, particularly where users cannot reasonably understand model training or profiling implications.

9. Reliability, Bias, and Responsible Evaluation

Reliability includes more than uptime. Relevant dimensions are factual accuracy, groundedness, consistency, latency, safe refusal, availability, recoverability, and resistance to adversarial inputs. A system may be available 99.99% of the time and still be operationally unacceptable if it frequently gives unsafe answers.

Evaluation should combine:

1. Offline benchmark tests: repeatable labelled examples and adversarial cases.

2. Human assessment: rubric-based review by trained evaluators.

3. Online monitoring: user feedback, escalation, incident, and drift signals.

4. Business measures: completion, support resolution, error cost, and satisfaction.

A test set must be representative of real use and protected from contamination. A single aggregate accuracy score can conceal poor performance for a language, disability group, demographic group, or rare but high-severity scenario. Fairness analysis should therefore report subgroup performance where lawful and ethically justified, while avoiding unnecessary collection of sensitive attributes.

Bias can enter through historical data, labels, sampling, language coverage, proxy variables, ranking objectives, and human feedback. Mitigation may involve better data, reweighting, prompt and policy changes, threshold adjustment, human review, or restricting the use case. No mitigation is universal; reducing one disparity can worsen another. Decisions should be documented with an impact assessment and a clear statement of residual risk.

10. Operational Cost and Performance

AI economics are affected by input tokens, output tokens, model choice, retrieval, storage, network transfer, caching, moderation, observability, and human review. If a provider charges a unit price per million tokens, a simple variable model cost is:

\[

C_m = \frac{N_i p_i + N_o p_o}{1{,}000{,}000}

\]

where \(N_i\) is input-token volume, \(N_o\) is output-token volume, and \(p_i\) and \(p_o\) are the corresponding prices per million tokens. This estimate assumes the prices are applicable to the selected model and that no additional provider charges are omitted. Total cost should add retrieval, infrastructure, monitoring, and human-review costs.

For example, if a workload uses 2,000,000 input tokens at $3 per million and 500,000 output tokens at $12 per million, model cost is:

\[

C_m = (2{,}000{,}000 \times 3 + 500{,}000 \times 12)/1{,}000{,}000 = 6 + 6 = \$12.

\]

This is a workload estimate, not a per-request price. If the workload contains 10,000 requests, the average model cost is $0.0012 per request before other costs. In practice, token distributions are highly variable, so percentile cost and worst-case budget controls are more useful than averages alone.

Cost reduction techniques include context compression, retrieval rather than full-document prompting, semantic caching where freshness permits, smaller models for simple tasks, batch processing, response limits, and routing by risk. Cost optimisation must not undermine safety or evidence quality.

11. Illustrative Case: University Service Assistant

Background

A fictional university, Northbridge University, wants to provide a web assistant for questions about enrolment, examinations, fees, and academic regulations. The university has multiple campuses and frequently changes deadlines.

Problem

A general chatbot produced plausible but outdated answers. Students also asked questions involving personal records, such as fee balances and progression status. The university needed current, campus-specific information without exposing one student's data to another.

Analysis

The risks were categorised as follows: stale knowledge, cross-student disclosure, incorrect interpretation of regulations, excessive confidence, and high review workload. The project team decided that public policy questions and private record questions required different workflows.

Approach and solution

The team created a versioned document repository with owner, campus, effective date, and access-classification metadata. Documents were chunked by policy section and indexed using hybrid retrieval. Access filtering occurred before context construction. Public questions used policy retrieval; private questions invoked authenticated university APIs through narrowly defined tools.

The model was required to return an answer, source identifiers, a confidence category, and an escalation flag. The server validated the schema and checked that citations belonged to retrieved documents. It refused to answer when sources conflicted or when a question required an unauthorised student record. High-impact progression and appeal questions were routed to staff, with the retrieved policy and draft response displayed to the reviewer.

The university created an evaluation set containing ordinary questions, outdated-policy traps, cross-campus differences, prompt-injection documents, multilingual queries, and attempts to access another student's information. Monitoring tracked unsupported claims, escalation rate, response latency, cost, and subgroup outcomes.

Outcome

The assistant became useful for routine policy navigation while remaining deliberately limited for individual academic decisions. Staff received fewer repetitive questions, but the project did not eliminate human service channels. The most important improvement came not from a larger model but from document governance, access filtering, structured validation, and explicit escalation.

Learning points

1. Current information requires a governed retrieval source, not merely a more capable model.

2. Personal data should be accessed through authorised application services, not inferred from prompts.

3. Human oversight is most effective when reviewers receive evidence and clear escalation reasons.

4. Evaluation must include adversarial and high-impact cases, not only typical questions.

12. Contemporary Developments and Best Practices

Multimodal models increasingly process images, audio, documents, and video, enabling accessibility tools and richer interfaces. Smaller and specialised models support edge deployment, lower latency, and data locality. Model gateways and open interoperability conventions are making it easier to switch models and tools, although compatibility and security still require testing. Retrieval systems are becoming more agentic, with query decomposition and iterative evidence gathering; this improves difficult searches but increases the need for step limits and audit trails.

Recommended engineering practices are:

• define the use case, harm model, and acceptable failure before selecting a model;
• keep authentication, authorisation, validation, and transactions deterministic;
• use retrieval for changing or private knowledge and enforce access filtering before generation;
• require structured outputs for workflow integration;
• design abstention, escalation, and rollback paths;
• maintain versioned prompts, models, indexes, policies, and evaluation sets;
• log enough for audit while minimising personal data;
• test security threats, subgroup behaviour, cost, latency, and failure recovery;
• monitor production performance and investigate incidents systematically;
• document provider dependencies, data locations, retention, and contractual responsibilities;
• involve domain experts, security specialists, accessibility professionals, and affected users.

Regulatory obligations vary by jurisdiction and use case. Organisations should conduct privacy and impact assessments, classify high-impact uses, preserve accountability, and maintain records appropriate to applicable data-protection, consumer-protection, accessibility, intellectual-property, and AI-governance requirements. Compliance is a baseline; responsible engineering also asks whether a proposed use is socially justified and proportionate.

Chapter Summary

AI-enabled web engineering combines probabilistic models with deterministic application controls, governed data, human judgement, and operational monitoring. Prompting, retrieval, fine-tuning, tool use, and agents serve different purposes and carry different risks. RAG can provide current and private knowledge, but its value depends on document governance, access filtering, chunking, ranking, and evidence evaluation. Structured outputs constrain syntax but do not guarantee truth, so semantic and business validation remain necessary.

Human oversight should be matched to risk and supported by evidence, uncertainty indicators, and explicit escalation rules. AI-assisted development and testing can increase productivity, but generated code and tests require independent review. Personalisation must balance relevance, autonomy, fairness, and privacy. Security requires controls beyond prompts, including identity, isolation, tool restrictions, and protection against injection and exfiltration. Reliability evaluation should measure groundedness, subgroup performance, latency, cost, safe refusal, and real-world outcomes. Sustainable deployment requires token budgeting, model routing, caching, observability, and governance across the complete system lifecycle.

Key Terms

AI-enabled web application: A web system that incorporates AI models into user-facing or backend functionality.

Agent: A system that uses a model to plan and execute multiple steps, often involving tools.

Embedding: A numerical representation used to compare semantic similarity between items.

Fine-tuning: Updating model parameters using task-specific training examples.

Grounded generation: Generation constrained or supported by identified evidence.

Hallucination: An unsupported or incorrect model-generated claim.

Human-in-the-loop: A workflow in which a person reviews or approves an AI output.

Hybrid retrieval: Combining lexical and vector-based search methods.

Indirect prompt injection: Malicious instructions embedded in content supplied to a model.

Model gateway: A service that standardises model access, policies, routing, and metering.

Prompt injection: An attempt to manipulate model instructions through input content.

Prompting: Supplying instructions and context to a model at inference time.

RAG: Retrieval-augmented generation, in which retrieved evidence is supplied to a generative model.

Recall: The proportion of all relevant items that a retrieval system finds.

Reranking: Reordering retrieved candidates using a more discriminating method.

Structured output: A response constrained to a defined schema and data format.

Tool calling: A model's request to invoke a controlled application operation.

Vector search: Retrieval based on similarity between numerical representations.

Review Questions

Short Answer Questions

1. Distinguish deterministic and probabilistic responsibilities in an AI-enabled web application.

2. What is retrieval-augmented generation, and when is it preferable to relying on model memory?

3. Why does valid JSON not guarantee a correct AI response?

4. Define prompt injection and explain why prompts are not a security boundary.

5. State two purposes of human oversight in AI-enabled workflows.

Long Answer Questions

1. Explain a reference architecture for an AI-enabled web application and the role of each major layer.

2. Discuss how chunking, metadata, hybrid retrieval, reranking, and citation verification affect RAG quality.

3. Critically evaluate AI-assisted software development and testing in a professional engineering team.

4. Explain the privacy, security, and fairness risks of AI-based personalisation and propose controls.

5. Develop an evaluation and monitoring strategy for a high-impact AI web feature.

Analytical / Application Questions

1. Design a RAG-based assistant for a regulated organisation. Specify its data model, access-control approach, structured output, escalation rules, and evaluation set.

2. A product team reports increased engagement after deploying personalisation, but complaints and subgroup disparities have also increased. Analyse the evidence and recommend a decision framework.

3. A web assistant costs $3 per million input tokens and $12 per million output tokens. A workload uses 2 million input tokens and 500,000 output tokens. Calculate model cost, state the assumptions, and identify at least three additional costs that must be considered before deployment.

Multiple Choice Questions with Answers

Question 1

Which responsibility should remain primarily deterministic in an AI-enabled web application?

A. Generating a conversational summary

B. Selecting a creative writing style

C. Authorising a payment transaction

D. Suggesting alternative wording

Correct Answer: C. Authorising a payment transaction

Question 2

What is the main purpose of retrieval-augmented generation?

A. To eliminate the need for access control

B. To provide relevant external or organisational evidence to a model

C. To guarantee that every generated statement is true

D. To replace all application databases

Correct Answer: B. To provide relevant external or organisational evidence to a model

Question 3

If 80 retrieved documents are relevant and 100 documents are retrieved in total, what is retrieval precision?

A. 20%

B. 50%

C. 80%

D. 125%

Correct Answer: C. 80%

Question 4

Which statement about structured outputs is correct?

A. A valid schema guarantees factual correctness

B. Structured outputs remove the need for server-side validation

C. Structured outputs constrain format but require semantic validation as well

D. Structured outputs are useful only for chatbot interfaces

Correct Answer: C. Structured outputs constrain format but require semantic validation as well

Question 5

Which is an example of indirect prompt injection?

A. A user changes a password through an authorised form

B. A malicious instruction is embedded in a document retrieved by the system

C. A developer writes a database migration

D. A model returns valid JSON

Correct Answer: B. A malicious instruction is embedded in a document retrieved by the system

Question 6

A model gateway commonly provides which capability?

A. Physical network cabling

B. Provider routing, usage metering, and policy enforcement

C. Automatic legal approval for every use case

D. Replacement of identity management

Correct Answer: B. Provider routing, usage metering, and policy enforcement

Question 7

Why should generated code from an AI coding assistant undergo independent review?

A. Generated code is always syntactically invalid

B. The assistant may introduce security defects or incorrect assumptions

C. Review is required only when code contains comments

D. Independent review prevents all future defects

Correct Answer: B. The assistant may introduce security defects or incorrect assumptions

Question 8

Which human-oversight pattern requires approval before an AI-proposed action is executed?

A. Human-in-the-loop

B. Human-off-the-loop

C. Unsupervised automation

D. Passive logging

Correct Answer: A. Human-in-the-loop

Question 9

Using the chapter's cost formula, what is the model cost for 2 million input tokens at $3 per million and 0.5 million output tokens at $12 per million?

A. $3

B. $6

C. $9

D. $12

Correct Answer: D. $12

Question 10

Which practice best protects against cross-tenant data leakage in a RAG system?

A. Adding more persuasive system instructions

B. Filtering retrieved data using tenant authorisation before context construction

C. Increasing the model temperature

D. Removing audit logs

Correct Answer: B. Filtering retrieved data using tenant authorisation before context construction