1. Define the task and boundary
A fictional company wants employees to ask questions about internal travel and expense policies. The assistant should answer only from documents the employee is allowed to access, cite the relevant source, and say when evidence is missing or conflicting. Policies change frequently. The system does not approve expenses or send payments.
Define success beyond fluency: useful answers supported by current authorized evidence, appropriate abstention, acceptable latency, and low rates of sensitive-data exposure. A convincing answer with an outdated policy can still be wrong.
Write an example of an unanswerable question and a question whose answer exists but is not authorized for the requesting employee. What should the system do in each case?
2. Design the evidence path
Ingest approved documents with source identifiers, effective dates, and access metadata. Parse and split them into retrievable passages, then index them with a versioned embedding configuration. At request time, authenticate the employee and restrict retrieval to permitted, applicable documents before sending context to the model. Treat retrieved text as untrusted data; instructions inside a document do not grant authority to call tools or expose information.
Decide how updates, deletions, permission changes, and caches propagate. A document may be relevant but stale, or current but inaccessible to a particular user. Log enough identifiers and versions to investigate without unnecessarily storing sensitive content.
3. Evaluate retrieval and answers separately
Suppose a small development set contains 20 answerable questions, each with at least one labeled relevant passage. For 16 questions, at least one relevant authorized passage appears in the top five results. The hit rate at five is 16/20 = 80%. This says nothing by itself about whether the generated answer is correct, whether the source is current, or how the system performs on unanswerable questions.
Create separate cases for missing evidence, outdated policies, conflicting sources, permission changes, prompt injection, and ordinary requests. Review retrieval relevance, source authorization and freshness, answer correctness, evidence support, and abstention as separate dimensions. Calibrate any model-based judge against human review and inspect false passes on critical cases.
A current authorized passage is retrieved, but the answer invents a reimbursement limit. Which part of the path should you investigate first? Answer: inspect context assembly, prompt, and generation behavior; the presence of the relevant passage suggests retrieval alone is not the full explanation.
4. Apply release gates
Assume a candidate improves average answer helpfulness but exposes a restricted document in one permission-revocation test. Do not treat the average improvement as a substitute for the access-control gate. Block the release, fix and retest the authorization and cache invalidation path, then rerun the broader regression set. Record the model, prompt, index, source snapshot, access-policy version, and evaluation results.
For an approved candidate, start with a limited rollout and define operational and safety guardrails. Escalate uncertain or high-impact questions to the appropriate human owner. A small canary can reveal operational issues, while a separate evaluation is needed to establish quality and user impact.
5. Monitor and revisit
Track retrieval coverage, stale-source incidents, permission failures, answer quality from governed samples, latency, and cost. Test document updates and deletions, and repeat critical cases after changing the model, prompt, parser, index, or access rules. A retrieval hit is not proof of a correct answer; a grounded answer is not proof that the source remains current.
Identify the system’s trust boundaries, a measurable retrieval metric, a critical release gate, and the evidence needed to diagnose a stale answer.
Continue with grounded generation, generative AI evaluation, and ML workflow security.