RAG context engineering: make source authority visible

OutsourcingVN is operated by Netbase JSC, which scopes and builds retrieval assistants, so we have an interest in your decision. The method applies whoever builds yours. This guide is for CTOs, knowledge owners and support or operations leads who want an assistant to answer from company documents without leaking or inventing.

Where the underlying data is not yet ready, start with the data platform readiness assessment; once several workflows need the same governed sources, retrieval index and evaluation store, data and AI platform engineering builds that shared foundation rather than a one-off copy per workflow. The neighbouring decision of ranking or matching records instead of grounding an answer is covered in the embeddings and semantic search guide.

What this guide covers

• Which source is the truth for each answer?
• Which retrieval architecture fits?
• How do you build the evaluation pack?
• A worked example: one HR policy question
• How do you handle injection and tool access?
• What has Netbase delivered in this area?
• Which questions should you ask a supplier?
• What failure modes should you watch for?
• Common questions
• How this guide is sourced
• Bring a source register and real questions

Which source is the truth for each answer?

For each kind of question the assistant will answer, name the system or document that owns the fact, its owner, how it is updated, who may read it, and how long it is kept. A policy PDF, a support ticket, a wiki page and a customer record carry different authority. When two disagree, a person must already have decided which one wins; retrieval cannot settle that on its own.

The practical output is a source register: one row per collection with owner, authority rank, effective-date field, access group and refresh trigger. Everything later in the build reads from it. Ingestion attaches its fields to every chunk as metadata, retrieval filters on them, and the answer contract uses them to decide whether to cite, warn about age or escalate.

Which retrieval architecture fits?

Most buyer projects end up with the first or second row, often both. Hybrid retrieval, combining keyword matching with embeddings and then reranking the top results, usually handles product codes, names and exact phrases better than embeddings alone. Chunk along document structure (sections, clauses, table rows) rather than fixed character counts, and store the source, section, version and access group with each chunk so an answer can cite precisely.

A worked example: one HR policy question

An HR team wants an assistant for staff questions. The source register lists the employee handbook (owner: HR policy lead, effective-dated, all staff), country addenda (owner: country HR, visible to that country's staff) and a contractor guide (owner: procurement, contractors only).

During testing, the contractor case fails: the assistant quotes the employee handbook. The cause is that permissions were applied after retrieval, so handbook passages reached the prompt. The fix is to filter by access group inside the search query itself. The rerun passes, and the permission suite now includes that case permanently.

How do you handle injection and tool access?

Retrieved text is data, not instruction. OWASP documents indirect prompt injection through webpages, files and other external content, and notes that retrieval does not remove the risk. Keep system instructions separate from retrieved passages, mark passages as quoted material in the prompt, restrict tools to the minimum, validate structured outputs in code, and require approval for any action that writes or sends.

Some retrieval products, RAGFlow among them, can expose search as a Model Context Protocol server. That is convenient for agents, and it widens the question to token handling, scopes, consent and revocation for every connected client. A document that tells the model to reveal data is hostile input and must never become an instruction to the application.

Which questions should you ask a supplier?

What failure modes should you watch for?

How this guide is sourced

Statements about Netbase map to approved claims backed by attested company facts listed under Sources, in their registered wording. External guidance comes from OWASP's prompt injection entry, NIST's generative AI profile and RAGFlow's MCP documentation, each dated below. The HR example is illustrative and describes no client. The knowledge base modules listed above are content-management delivery, not retrieval AI. This page does not assess the rights to use your documents or the fitness of any product. See the methodology for how claims are reviewed.

Bring a source register and real questions

A first conversation goes furthest with a draft source register and twenty or so real questions, including a few that should be refused. Submit a project with them, or read the emerging technology adoption guide, the production inference assessment and the other guides first. An AI Workflow Blueprint is the assessment route when source authority is still unclear. OutsourcingVN is operated by Netbase JSC and is Netbase's own outsourcing-services platform.

Related services and solutions

Sources

• OWASP GenAI Security Project, LLM01 Prompt Injection
• NIST, AI Risk Management Framework: Generative AI Profile
• RAGFlow documentation, MCP overview