The wrapper problem
Teams lose hours hunting across wikis, tickets, and repositories. Dropping a chat box on a dump of those sources looks like progress. It is not, if the model can retrieve a document the asker is not allowed to open.
Hallucinations are a quality problem. Leaking a restricted runbook is an access problem. We treat them separately.
Retrieve inside the same rules
We index the sources that matter and retrieve with hybrid search — keywords for identifiers, vectors for phrasing. Filters on the retrieval query reuse the identity and roles you already have, rather than inventing a second permission system for the model.
Answers stay tied to citations. If a chunk cannot be shown, it is not retrieved. The model does not get a secret “for context.”
// Pattern: Access-aware hybrid retrieval filter
interface SecureRetrievalQuery {
readonly userContext: { id: string; roles: string[]; tenantId: string };
readonly searchFilter: {
securityLabels: { $in: string[] };
aclGroups: { $in: string[] };
};
readonly hybridWeights: { bm25: 0.4; denseVector: 0.6 };
readonly citationRequired: true;
}Measure instead of demo
We score retrieval and refusal: did we find the right source, did we stay silent when we should have, did the citation match the claim. A demo that answers everything is usually a system that answers too much.
That is the same access-aware RAG approach we take on internal knowledge systems — not a generic wrapper, and not a claim about a named client result.
Have a similar architectural challenge?
Talk directly with a senior engineer about tradeoffs, cutovers, and sizing.