Retrieval-augmented generation, or RAG, lets an assistant answer from a company's own documents and data. A working demo takes an afternoon: load some files, embed them, ask a question. The production version is where the real work is.
Getting the right content in
Real documents are messy: scanned PDFs, tables, duplicates, old versions that contradict new ones. Ingestion needs cleaning, sensible chunking that keeps tables and headings together, and metadata such as source, owner and date, so the assistant can prefer the current policy over last year's.
Respecting who can see what
If a person cannot open a document, the assistant must not quote it to them. Access rules are applied when content is retrieved, not after the answer is written. This is the part most demos skip and the part that matters most to a security review.
Showing where the answer came from
Every answer links to the passages it used. Citations let users check the answer, build trust faster, and make wrong answers easy to report and fix.
Knowing when to say "I don't know"
When retrieval finds nothing relevant, the right answer is to say so and, where it makes sense, hand over to a person. A confident answer with no source behind it is the most damaging thing an assistant can produce.
Measuring quality before and after changes
A fixed set of real questions with known good answers is run every time the prompts, the model or the documents change. Without it, every improvement is a guess and every regression is found by a customer.
Keeping it fresh and affordable
Documents change, so the index is updated on a schedule or when content changes. Cost and response time are tracked per request, and frequent questions can be cached.
The model is the easy part. The data, the access rules and the checks around it are what make an assistant safe to put in front of people.