Define source authority
A private RAG system combines source content, ingestion, embeddings, a vector store, retrieval filters, prompt construction, and a model endpoint. The source system remains authoritative for document and permission decisions.
Design ingestion and provenance
Record source, version, chunking method, embedding model, tenant or permission metadata, ingestion time, and deletion path. A source permission change must reach the index.
Enforce retrieval boundaries
Build filters from trusted identity data, not caller-supplied fields. Test allowed documents, cross-tenant requests, revoked documents, and ambiguous queries. Similarity ranking is not authorisation.
Evaluate answer and access quality
Use safe representative questions to inspect retrieved chunks, citations or references, exclusions, latency, and model routing. Measure failures before exposing sensitive business data.
RAG contract
Version the boundary.
| Layer | Decision | Evidence |
|---|---|---|
| Source | Authority and permissions | Owner record. |
| Index | Schema and embeddings | Write/query test. |
| Retriever | Trusted filters | Cross-tenant denial. |
| Model | Approved endpoint | Safe prompt test. |
Questions
Can a vector score grant access?
No; authorisation requires trusted filters.
What changes require reindexing?
Embedding, chunking, schema, or major permission corrections.
What proves safety?
Access, deletion, and endpoint-path tests.
Build stages
Inventory sources and permissions.
Test relevance and denials.
Review sources and versions.
Checks
Keep operating evidence.
Source register
Owners and authority are known.
Access test
Cross-tenant retrieval is denied.
Delete test
Revoked content stops returning.
