In this article
The essential idea
RAG retrieves relevant information before a model writes an answer. Its business value depends on the documents it can access, the evidence it selects and its ability to decline an unsupported answer.
Start with a question the business actually asks
Retrieval-augmented generation combines a language model with information retrieved from an external collection. The original RAG paper describes this combination of model knowledge and retrieved knowledge. In a company, the practical objective might be to answer a support question using the applicable procedure and show where that procedure comes from.
Consider an internal assistant asked whether a returned item qualifies for replacement. An impressive answer is not enough: the assistant must identify the product, country and relevant policy version. Our recommendation is to start with one document family and a named business owner. Define which questions are in scope, what evidence an answer must contain and when the case returns to a person.
Build a document lifecycle before choosing a database
A useful ingestion pipeline extracts text, preserves headings and tables, and associates each passage with a stable document identifier. We would also keep the source URL, owner, language, revision, effective date and access labels. A passage without this context can sound correct while applying to the wrong contract or an obsolete product.
Treat ingestion as a repeatable job. Record failed imports, distinguish replacement from duplication and propagate deletions into the index. For a pilot, deliberately update a procedure and remove another one, then verify what the assistant can retrieve. This small exercise often reveals more about production readiness than a polished demonstration with a frozen collection.
An answer starts with a source
A proposed RAG path: permissions apply before evidence enters the model.
Documents
Keep the source, revision and owner.
Access
Select only the user’s authorised material.
Retrieval
Find passages relevant to the question.
Cited answer
Answer with evidence, or ask for clarification.
Apply permissions before information reaches the model
The retrieval request should carry access constraints derived from the authenticated user. Microsoft documents a security-filter pattern that restricts search results using indexed identity fields; the filter itself is not authentication. In our proposed architecture, the application establishes identity and permissions, then enforces them at retrieval time. A prompt asking the model to ignore confidential documents is not an access control.
Test two people asking the same question with different permissions. Check returned passages, generated text, citations and caches. A shared response cache must not reuse one user’s privileged answer for another. Logs also need a retention policy: recording complete retrieved documents can create a second, less controlled copy of the knowledge base.
Deliver evidence, an exit path and an operating model
Ask for answers tied to identifiable passages, and verify that the linked source supports the claim. When evidence is missing or contradictory, the useful result may be a clarification question or an explicit handover. For the return-policy example, guessing the country would be worse than asking for it.
A production handover should include the ingestion schedule, document owners, a representative evaluation set and a rollback procedure for index or model changes. At MASLOV Solutions, this is the scope we would propose for a RAG engagement: connect the sources, implement retrieval and permissions, integrate the interface, and establish the checks needed to operate it. The right database follows these requirements; it does not replace them.
Walk a warranty question through the system
An adviser asks whether a damaged item can be replaced. First resolve the customer, product and applicable country from authorised records. If a required field is absent, ask for it before searching. Retrieve the current policy together with relevant exceptions, then generate a proposed answer that separates the rule from the facts of this case.
Do not turn the answer directly into a replacement order. The proposal can cite the policy while the business service separately checks eligibility and authority to create the order. If two applicable documents disagree, route the case to their owner. This division keeps document interpretation useful without allowing a fluent response to override transaction rules.
A RAG answer needs an evidence gate
Proposed architecture for the warranty example. Returning a cited answer does not itself authorise a replacement order.
Identify user and case → retrieve permitted passages
Applicable, sufficient and consistent evidence?
Yes
- Draft answer with source passages
- Check claims → return cited proposal
No
- Do not infer the missing policy
- Ask for context or hand over the conflict
A document update is an observable event
Suppose the policy changes on Monday. An ingestion job should identify the new revision, rebuild affected passages and stop serving the superseded version where it no longer applies. Record the effective date separately from the import time; a future policy must not silently replace the rule for a current case.
After publication, run the warranty questions affected by that change and inspect their citations. Include a deletion and a permission revocation in the same rehearsal. Give the document owner a visible status for accepted, rejected and stale imports. A useful operating view connects a wrong answer back to a source revision or failed job, so the team can fix the right stage.
Sources & further reading
Documentation consulted on .
FAQ / DECISIONS
Frequently asked questions
Does RAG eliminate hallucinations?+
No. Retrieval can return incomplete or irrelevant evidence, and a model can misinterpret it. Source checks, evaluation and a clear refusal path remain necessary.
Must all documents be migrated first?+
No. Start with a maintained collection that covers one useful workflow. Expand after checking permissions, updates and answer quality with its business owner.