Production RAG: authorization, hybrid search, and grounding

What you will be able to do

1. Filter by authorization before content reaches generation.
2. Validate citations and abstention.
3. Test injection, stale, conflicting, and cross-user cases.

Prerequisites: dictionaries, loops, functions, exceptions and installed Python or paper tracing. Reuse earlier Builder artifacts only when the task requires them.

This curriculum runs self-study on VetsLearn. Where the text calls for an instructor, peer or formal review, use the stated acceptance criteria for self-review. Reflection questions support reflection; they do not replace independent assessment. A peer review is optional unless your actual organization requires it.

Part 1 Technical instruction

Secure retrieval is an ordered pipeline: authenticate the principal; derive server-side entitlements; filter candidates; rank only authorized content; assemble bounded context; generate; validate citations against retrieved spans; and abstain when evidence is insufficient. Post-retrieval filtering is dangerous because unauthorized content may already have influenced ranking, caching, or the model. Retrieved text is untrusted data, even when stored internally. Instructions inside documents never override application policy. Index version and deletion state must be visible in citations and refresh controls.

Mechanism and implementation

Authorize candidates before model context assembly and revalidate cache reads. Prevent unauthorized influence throughout the path, rather than hiding only the final text. Hybrid search cannot repair entitlements. Validate cited source ID, revision and exact supporting span after generation. Retrieved instructions never grant tool authority.

Constructed offline example

Save as topic_example.py and run python topic_example.py with an installed Python 3.11+ interpreter. This standard-library construction uses synthetic values; its checks are not provider measurements.

docs = [{"id": "a", "tenant": "one", "text": "Room 4"},
        {"id": "b", "tenant": "two", "text": "Private Room 9"}]
def candidates(tenant):
    return [d for d in docs if tenant is not None and d["tenant"] == tenant]
def supports(key, claim, tenant):
    return any(d["id"] == key and claim in d["text"] for d in candidates(tenant))
assert [d["id"] for d in candidates("one")] == ["a"]
assert candidates(None) == []
assert not supports("b", "Room 9", "one")
print("cross-tenant citation rejected")

Engineering decisions

• Choose pre-retrieval enforcement and cache partitioning.
• Set evidence and abstention thresholds.
• Resolve conflicts by source authority and currency, not model confidence.

Worked example

Two users share a corpus but have different entitlements. The retriever filters before scoring. A poisoned document says to reveal another user’s record; it is treated as content. Citation validation rejects a generated source ID not present in the retrieved set.

Diagnose the failure

Unauthorized content never reaches context/output; deleted citations fail; instructions grant no permission. Stop leakage and repair shared authorization before further generation experiments.

Part 2 Guided practice

Trace tenant one through candidates, ranking, context and citations. Add a cached tenant-two answer and deny reuse. Independently test a deleted source and injected document instruction.

Answer criteria and feedback: Unauthorized content never reaches context/output; deleted citations fail; instructions grant no permission. Stop leakage and repair shared authorization before further generation experiments.

Continue with the downloadable pack below. If the pack or interpreter is unavailable, trace this self-contained example by hand in an input/expected-status/controlling-rule table and label execution unverified. Do not invent passing output. No account, credential, paid call, purchase or actual deployment is required.

Part 3 Remediation

Trace one request through identity, entitlements, candidate set, ranked set, context, and citation check. If leakage occurs, stop; do not continue to generation experiments. After repair, reassess with the alternate scenario in scenario_alt.json. A critical authorization, data-handling, evidence-integrity, or prohibited-action failure cannot be averaged into successful practice; it requires targeted remediation.

Part 4 Sources and currency

• https://genai.owasp.org/
• https://airc.nist.gov/Docs/Generative_AI_Profile.pdf

Use the workflow decision reference for model/deployment/harness distinctions and controlled comparisons. Source currency must be checked before each cohort. Provider/product behavior is illustrative where mocked; resolve current interfaces only from official documentation in an authorized environment.