Retrieval-augmented generation, or RAG, finds relevant material before an AI system drafts an answer. Commissioning a useful RAG assistant therefore means buying more than a chat screen: the project needs a controlled way to select, update, search, and protect the sources behind that screen.
This guide covers implementation decisions for teams comparing RAG development services. It focuses on ownership and evidence: which document was used, whether the reader may see it, and what happens when the document changes. It does not assume every organization needs a large enterprise search platform.
Related service: AI automation services- 01Approve a source and its owner.
- 02Extract content while preserving useful context and access metadata.
- 03Retrieve only material the requester may read.
- 04Draft an answer with traceable references.
- 05Refresh, revoke, or remove sources and retest.
SECTION 01
Start with a source inventory, not a folder upload
List each source collection, its owner, format, update frequency, audience, and approved use. Note duplicated documents, scans, tables, and information that is obsolete. If two policies conflict, the business owner needs to choose the authoritative one; search technology cannot resolve that decision for you.
A small pilot can use a curated collection with manual refresh. A wider assistant may need connectors, scheduled updates, deletion tracking, and failure alerts. Ask the agency to separate those options. Microsoft's RAG overview describes content preparation and relevant retrieval as central parts of the system, not incidental setup.
SECTION 02
Carry access rules through every stage
Identify users through your approved sign-in system and define the documents each role may retrieve. When a document is split into smaller searchable passages, those passages need the appropriate access metadata too. Do not retrieve restricted material and rely on the model to hide it later.
Microsoft documents several ways to enforce document-level access, including application-managed filters and platform-specific identity features. Availability and behavior vary by source and feature. Require a demonstrated access test for your chosen design rather than treating a product checkbox as proof that your whole permission model works.
SECTION 03
Worked example: an internal product knowledge assistant
Consider an illustrative distributor with public product manuals and restricted supplier agreements. The first release helps support staff find manuals and troubleshooting notes. Purchasing staff may also search approved supplier terms. Both groups use the same interface, but the retrieval results differ according to their permissions.
The source owner replaces an installation manual and withdraws an old version. Acceptance testing checks that new answers cite the current manual and that the obsolete passages are no longer retrieved. The test also checks previously cached answers and references, because removing the original file may not remove every stored copy.
A support user asks for a confidential supplier discount. The assistant must not expose that figure, paraphrase it, or link to a restricted source. A purchasing user asking the same question should receive the permitted evidence. This paired test is more informative than a demonstration using an administrator account.
SECTION 04
Evaluate search quality and answer quality separately
For each sample question, record which source passages should be found. If the correct material never reaches the model, changing the response wording will not repair retrieval. If the right passage is present but the answer changes its meaning, investigate the generation and validation step instead.
Include questions with no answer, similar product names, dated policies, incomplete tables, and attempts to override instructions through document text. Test whether a citation actually supports the associated statement. Keep examples of failure and expected behavior so later source, model, or configuration changes can be checked against the same cases.
| Case | Evidence to request |
|---|---|
| Known answer | The relevant passage is retrieved and accurately represented. |
| Missing information | The assistant explains the gap without inventing a policy. |
| Revoked access | Restricted content is no longer returned to that user. |
| Updated source | The current version replaces obsolete retrieval content. |
SECTION 05
Make ongoing source care affordable and explicit
At handoff, your owner should be able to see which sources are current, which failed to import, and how to remove a collection. Agree how quickly a document or permission change must be reflected. Specify account ownership, logs, retention, backups, and the process for reporting an unsafe answer.
Remote U.S. and international buyers should also agree where approved data may be processed and who can support the system. Keep requirements specific to your organization instead of assuming a universal arrangement. A narrow, well-maintained collection is often a more manageable first release than connecting every repository at once.
SECTION 06
Frequently asked questions
What does a RAG development project include?
It should cover approved sources, content preparation, retrieval, answer generation, permissions, source updates, evaluation, and operating handoff. The required connectors and interface depend on the use case.
Can RAG guarantee that an AI answer is correct?
No. Relevant sources and citations help, but retrieval and interpretation can still fail. Test representative questions and make unsupported or uncertain answers visible to the user.
Do all company documents belong in the first release?
No. Start with a collection that has a clear owner, useful coverage, and manageable permissions. Expand only after source updates, access changes, and answer quality have been tested.
PRIMARY REFERENCES
Sources and further reading
These references cover the standards, platforms, or published prices discussed in the guide. Worked examples and checklists are our editorial guidance.
- Retrieval-augmented generation in Azure AI SearchMicrosoft Learn
- Document-level access controlMicrosoft Learn
EDITORIAL METHOD
About this guide
We use AI to assist with drafting and editing. Catapult AI Work is responsible for the published content. Examples illustrate possible approaches; they are not client case studies unless identified as such.
Budget examples are not Catapult package prices. Check linked provider pages for current fees and plan limits before making a purchase.
Read the editorial policy