The practical answer
A retrieval-augmented generation application combines search with generation. It should retrieve relevant source material, preserve permissions, and make it easy for a user to inspect the evidence behind an answer.
A production RAG pipeline
Prepare the corpus
Identify authoritative sources, owners, update frequency, access rules, retention requirements, and document versions. Remove duplicates and preserve useful structure such as headings, page numbers, tables, and timestamps.
Index for the real questions
Chunking and embeddings are implementation choices, not goals. Build a representative query set first. Test lexical, vector, hybrid, metadata, and reranking approaches against that set rather than assuming one method is best.
Enforce access before retrieval
Filter by tenant, user, role, matter, or document permission before content reaches the model. Hiding unauthorized citations after generation is too late.
Generate from evidence
Ask the model to answer only from retrieved material, identify uncertainty, and cite source locations. Validate structured outputs and do not treat a citation as proof that the accompanying statement is correct.
Evaluate each layer
Measure retrieval recall, ranking quality, answer correctness, citation support, access-control behavior, latency, cost, and failure handling. Include adversarial documents and indirect prompt injection in the test set.
Keep the index current
Use versioned ingestion, deletion propagation, re-indexing, and monitoring. Users should be able to tell when a source was last updated.
RAG improves grounding only when retrieval, permissions, evidence, and evaluation are designed together.
Fact-check sources
- OWASP Top 10 for LLM Applications
- OWASP Top 10 for Agentic Applications 2026
- NIST AI Risk Management Framework
- OpenAI API models and pricing
Sources and product documentation can change. Recheck time-sensitive pages on the publication date.