Fine-Tuning vs RAG vs Prompting + LoRA on a Small Model — Cheat Sheet

• Start with the local contract and explicit acceptance criteria.
• Treat prompts, retrieved content, tool output, and protocol messages as untrusted.
• Keep identity, authorization, policy, telemetry, cost, and cleanup explicit.
• Prefer the smallest orchestration or adaptation that satisfies the evidence.