Retrieval finds candidate evidence; grounding constrains an answer to that evidence; citations connect claims to inspectable sources. A production retrieval path also enforces tenant scope, access control, freshness, provenance, injection resistance, and abstention. Similarity alone does not establish truth, permission, or current applicability.
You will design a retrieval pipeline, produce claim-level citations, and evaluate whether evidence actually supports an answer.
Retrieval is an open-book exam with a fallible librarian. The librarian may return irrelevant, outdated, conflicting, or malicious pages. The agent must identify evidence; deterministic code must enforce who may see it.
Each document should carry a stable source ID, title, version, effective date, owner, access labels, and retrieval timestamp.
Return claims and citations in structured output rather than asking prose to contain reliable links:
The user interface can resolve source_id to an authorized link. Never let the model invent an unrestricted storage URL.
Measure at least:
An answer can be well written and still fail every important retrieval metric.
Failure injection: Index two policy versions and a page containing “ignore previous instructions.” The system should prefer the effective version, label the malicious line as document content, and never convert it into authority.
Log retrieval manifests with hashes rather than full sensitive text, version indexes, support deletion, and replay evaluations against preserved fixtures. Monitor zero-result rate, stale-source rate, cross-scope rejection, citation support, latency, and cost.
Build a ten-case evidence suite with current, stale, conflicting, missing, and injected documents. Score retrieval and answer generation independently.