Resources · Integration patterns
RAG ingestion and retrieval
Documents are indexed with their permissions and the model answers only from permitted, cited passages.
Integration status: Documented pattern
A documented pattern. The product has no RAG index.
Description
Documents are chunked, embedded and stored with metadata and permissions. On a question, retrieval filters by permission and the model answers only from the passages, naming the source.
Prerequisites
- Curated documents with owners.
- A permission model.
- A test set of questions.
When to use it
- Knowledge in documents that change.
- Answers need a source.
- Different access rights.
When not to use it
- The data is structured — use queries.
- Documents have no owner.
- The accuracy needed requires computation.
Reference diagram
An illustration of the components and the flow — not a running system.
01Ingestion
- Sources
- Chunking
- Metadata and permissions
02Index
- Vectors
- Keywords
03Answer
- Permission filter
- Model
- Citation
The diagram as a list
| Stage | Components |
|---|---|
| Ingestion | Sources, Chunking, Metadata and permissions |
| Index | Vectors, Keywords |
| Answer | Permission filter, Model, Citation |
Security controls
- Permission filtering before the model.
- Input treated as untrusted.
- No question content in logs.
Observability
- Share of answers with a source.
- Questions without results.
- Index freshness.
Failure modes
| Failure | Mitigation |
|---|---|
| Answer from an outdated document | Dates, owners and periodic clean-up. |
| Leak across permissions | Filter in retrieval, tests with roles. |
| Made-up answer | No source — no answer. |