Retrieval-Augmented Generation as a Data Flow

TL;DR: Retrieval-augmented generation supplies selected external evidence to a model during a request. Review how sources enter the search system, how the request selects permitted evidence, and where generated answers and derived copies go. Relevance scores do not establish reader permission, factual authority or deletion.

What you should be able to do

Draw the ingestion and request paths, mark the boundary between ranking and access, and follow revocation into saved answers. Explain which deletion claims remain unproved when a search returns nothing.

Retrieval is a way to supply evidence

An application can fetch records or passages and place them in the model’s current input. This makes information available without training the generator on each new record. The generator still has its previously learned capabilities and may use other context; retrieval does not erase its parameters or guarantee an answer uses only supplied passages.

Lewis and colleagues’ RAG paper combined a learned generator with an external dense index. In application design, retrieval can instead use keywords, vectors, structured queries or a combination. A vector database, fixed chunk size and embedding every query are common implementation choices, not defining requirements for every retrieval-backed assistant.

Use retrieval when the task needs controlled access to current or attributable information. Its freshness depends on ingestion, permissions, caches and the source itself. Its cost depends on the whole workload. Neither instant updates nor lower cost than every alternative follows from the label “RAG.”

Ingestion decides what can become evidence

For an original fictional makerspace assistant, the sources are public equipment manuals, member-authored usage notes and staff-only maintenance records. The asset is both confidential information and the reliability of equipment guidance. A member can edit their own usage note, but cannot publish an official safety policy or read staff records.

A connector needs permission to read what it ingests. That service permission does not grant every assistant user access. Preserve a stable source identifier, version, classification and the information needed to resolve current access. Store permissions with chunks where appropriate, or consult an authoritative access service; a copied access list is only one implementation.

Parsing and chunking are transformations. A passage can lose a heading that says it is obsolete, separate an instruction from its warning, or mix content with different audiences. Preserve useful context and avoid combining incompatible access scopes. Bound file handling and resource use, and distinguish source text from metadata set by a trusted ingestion process. An author-written label saying “public” is not a permission grant.

Embedding services and external rerankers are processors too. Review what text they receive before the final generation request, rather than assuming the main model is the first place documents leave the source system.

Eligibility and ranking answer different questions

Eligibility: may this request use this source for this purpose and audience? Resolve the trusted principal, tenant, source policy and relevant current state. When required policy information is unavailable, withhold the affected evidence instead of treating the missing check as permission.

Ranking: which eligible evidence is useful for this question? Keyword matching, vector similarity, freshness and source authority can contribute different signals. A high similarity score does not independently establish truth, authorship or access. A source may be readable but unsuitable as the authority for an equipment-safety answer.

Prefer applying access restrictions early enough to prevent unauthorized processing and disclosure. Do not turn that into the claim that every internal ranking step must use the same physical filter. An authorized search backend may rank candidate identifiers before a final current-access check. What matters is which component can read the content, which policy it enforces, and whether anything leaves that protected boundary too soon.

Selecting a small unrestricted top-k and then removing denied entries can also harm usefulness. It may return nothing even though permitted, relevant records exist farther down the list. Measure result completeness under real access patterns. A larger candidate set or search-time filter must still preserve the access boundary; neither is permission to expose rejected text to an unapproved reranker.

Work the selection problem offline

These synthetic scores are illustrative rankings, not measured similarities. The trusted search service has four candidate IDs. Its current access decision permits only manual and hours. The following pure example compares eligibility-before-truncation with truncation-before-eligibility:

ranked = [("staff", 0.99), ("withdrawn", 0.98),
          ("manual", 0.80), ("hours", 0.75)]

def choose(candidates, allowed_ids, limit):
    eligible = [item for item in candidates if item[0] in allowed_ids]
    return [key for key, score in sorted(
        eligible, key=lambda item: (-item[1], item[0]))[:limit]]

allowed = {"manual", "hours"}
print(choose(ranked, allowed, 2))  # => ['manual', 'hours']
print(choose(ranked[:2], allowed, 2))  # => []
print(choose(ranked, {"hours"}, 2))  # => ['hours']
print(choose(ranked, set(), 2))  # => []

The first result contains both permitted records. The second is empty because the two highest candidates were both ineligible. The third models withdrawn access to manual; the fourth represents no permitted records. Do not fill an empty result with a denied passage just to improve answer completeness.

This function is not an authentication or policy service, and it does not model approximate vector search, concurrent changes or remote processing. Its allowed-ID set is assumed to come from a trusted current decision. It demonstrates a selection-order effect; production tests must inspect the real paths and timing.

Assemble and assess the answer

Attach source identifiers and useful provenance to selected evidence, preserve trusted message roles and bound the context. Source labels help interpretation, but do not make member-written instructions authoritative. Constrain consequential actions independently of generated prose. The context concept explains representation and budget choices.

For the makerspace, a member’s note might describe a machine as available while the authorized maintenance service marks it unavailable. A similarity score cannot resolve that conflict. Use the authoritative status source, explain the limitation, and avoid inventing a reservation or completion result.

A citation needs more than a plausible document title. Check that the cited record was actually available to this request and that the relevant passage supports the claim. Reader access to a source and correctness of a claim are separate checks. Validate destinations and rendering behavior for links and media; a visible link and an automatically fetched image have different network effects.

Access changes, deletion and reuse

A permission change can invalidate an old answer even if its question text is unchanged. Tenant-separated caches prevent some cross-tenant reuse, but do not by themselves account for changed group membership, source versions or a member’s individual access. Associate derived answers with their dependencies and revalidate, invalidate or avoid reuse when required state changes.

The deletion plan should list serving data, stored answers, logs, evaluation copies and backup handling. If data also trained a model, that is a separate lineage and remediation problem. Deleting a search row does not undo a parameter update. Conversely, an answer that still states a public fact does not prove a deleted private record survived: the fact may be available elsewhere.

Verify each claim with the matching evidence. Inspect authoritative source state, remaining derived artifacts, cache eligibility, query results and restore procedures. Use authorized synthetic fixtures for behavioral checks. A single refusal or unanswered query cannot prove complete erasure.

Turn the map into a review

Name the source writer, processing component, trusted identity and final audience at each boundary. Record the expected result for a permitted request, a cross-user request, revocation, a conflicting source and missing policy data. The worked pipeline question applies this to a review trace; embeddings explains what similarity and numerical representations do and do not establish.