Why RAG fails in production

Wikis contain the 2019 SOP and the 2024 SOP. Vector search will happily retrieve both. The generator will average them into a new policy that never existed. That averaged policy will be fluent, cited (badly), and wrong. Mitigation is not 'we'll tell the model to prefer recent.' Mitigation is metadata dates, a prefer-latest rule in retrieve, deprecation flags, and a knowledge owner who archives. If nobody archives, the index is a museum and a trap.

Duplicates are the quiet version. The same SOP pasted into three spaces, a PDF and a wiki page, an email attachment that became a page. Hybrid search returns three near-copies, k is used up, the actual exception clause in a fourth document never appears. De-duplicate at ingest by canonical URL or content hash. Retrieval that cannot say 'this is the same document' is how recall looks fine on paper (the gold is in the index five times) and fails in practice (the useful neighbor was crowded out).

Conflicting truth is a knowledge problem first. Two teams published opposite rules. The bot is the messenger. Your delivery move is to surface the conflict: retrieve both, show both dates, refuse to pick, name the owner who must archive one. Hoping the generator 'picks the latest' is how you launder a governance failure through a chatbot and then get blamed for the chatbot.

Re-index is a job with an SLA, not a cron nobody watches. When a source changes, either event-driven update or a documented lag ('answers may be 24h stale') that the UI shows. Silent staleness is how you get a 'the bot said we still do X' incident. The SLA has a number, an owner, a probe (a canary document you change and then query), and a page in the runbook for 'the connector died.'

Supersession at 4pm is the test. Policy owner updates SOP-14. Who notices. Who upserts. Who invalidates the old vectors. Who tells the UI. If the answer is 'nightly job, maybe,' then for 18 hours you will retrieve the old rule. For some corpora that is acceptable if printed. For safety, access, or customer commitments, it is not. Say which class this corpus is before you agree to nightly.

Versioned documents need a retrieve rule: current only, unless the user asks for history. Default current. Store archived chunks with a flag and a date, do not delete immediately (you will want history for audit), but do not let them into the default top-k. The stale-trap row in yesterday's eval exists to catch this. If that row fails, you do not have a date policy. You have a pile.

RAID this as: 'Index serves superseded SOP as current.' Impact: wrong operational guidance, possible compliance event. Owner: knowledge owner + index engineer. Trigger: canary page not reflected within SLA, or two current docs disagree. Mitigation: dates, deprecation, prefer-latest, UI lag banner, archive workflow. That is a row. 'We'll monitor' is not.

Stale, duplicate, and conflicting truth are knowledge problems wearing a chatbot. Dates, prefer-latest, deprecation flags, de-duplication by canonical URL or hash, a retrieve rule that defaults to current, and a knowledge owner who archives — those are the moves. Re-index is a job with an SLA, a canary document, and a UI banner when lag is real. Silent staleness is an incident class. Supersession at 4pm is the test; if the answer is 'nightly, maybe,' say which corpus class can tolerate that before you agree. Hoping the generator picks the latest is how you launder a governance failure through a bot and then get blamed for the bot. Surface the conflict. Refuse to pick. Name the owner. That is delivery. Averaging two SOPs into a third policy that never existed is not.

If the index was built with a service account that can see everything, retrieval will return the CEO's folder to an intern. Filter by the user's identity at query time, or maintain per-permission indexes. This is not a v2 item. It is a go-live item or you do not go live. A wrong paragraph is an error. A retrieval leak is a data incident, often worse.

The leak flow is simple and it keeps happening. Connector authenticates as a god account so ingest is 'easy.' Chunks are stored without permission groups, or with a group that means 'everyone in the tenant.' Query time uses the same god account. The intern asks a question that happens to be close, in meaning-space, to a strategy deck. The generator cites it. Screenshot in Slack. Now you have a problem that is not 'the answer was a bit off.'

Consumer chat UIs that 'just upload the drive' fail this test by construction. Enterprise search teams already know permission-aware retrieval. Invite them before you invent a worse version. If your company has an existing search ACL model, reuse it. Do not build a parallel permission universe because the vector DB tutorial did not mention users.

Query-time filtering is the usual pattern: every chunk carries a permission group (or ACL list). The request carries the user's groups from SSO. The index query includes a filter: permission in user_groups. Miss a group, you over-block (annoying, visible). Miss the filter, you leak (quiet, career-class). Over-blocking is the correct failure direction. Users will complain. Good. Complaints are cheaper than leaks.

Citations inherit ACL, as of yesterday. A deep-link that bypasses the wiki's own permissions is the leak with extra steps. The click goes through the same check. Cached pages, 'shared demo tenants,' exported PDFs of the index — all side doors. Side doors are in scope for security review. If security is not in the RACI, add them before ingest, not after the intern's screenshot.

POCs often index a copy of production with ACLs stripped 'to make it work.' That copy becomes the production pattern because it was easier, and because the demo went well. Kill it in writing. The no-go memo later today includes this sentence: we will not go live on a corpus whose permissions are not the production permissions. If the POC cannot work with ACLs on, the POC is lying about readiness.

Test the leak. Pick a user who should not see folder F. Ask a question whose gold lives only in F. Success: refuse or empty, not a redacted hint, not a title leak in the citation list. Title leaks count. 'I cannot show you the CEO_comp_review.pdf' is still a leak of existence and name. Eval this. Do not assume the filter works because the engineer said it was on.

ACL leaks are career-class because they are data incidents, not wrong paragraphs. God-account ingest plus query-as-service plus a citation is the flow; an intern plus a screenshot is the end. Query-time filter on the user's SSO groups, citations that inherit the same check, over-block rather than leak, leak-test as a go-live gate, no stripped-ACL POC that becomes production. Title leaks count. Invite enterprise search before you invent a worse permission universe because a vector tutorial skipped users. Kill the shared demo tenant in writing. If the POC cannot work with ACLs on, the POC is lying about readiness. This is not v2. This is go-live or you do not go live. Write that in the no-go even if it makes the date slip. Dates slip. Careers do not un-slip.

Nav chrome, cookie banners, 'click here,' scanned PDFs with no OCR, Excel dumps, meeting notes with no decision. Ingest must drop or flag these. A delivery lead can demand a sample of 20 chunks on a slide before funding the rest of ingest. If the sample contains a cookie banner, the index will retrieve a cookie banner, and the generator will quote it as policy. That is funny once. It is not funny in steering.

OCR and scans are a workstream. If half the SOPs are pictures of pages, you do not have a RAG corpus. You have a scanning project. Name it. Budget it. Do not hide it inside 'we'll embed Confluence.' Unreadable text still gets a vector. The vector is a vector of garbage. Neighbors of garbage are more garbage.

Meeting notes without decisions are a corpus smell. They retrieve well for 'what did we talk about' and badly for 'what did we decide.' If you index them, tag them as notes, not as SOP, and teach retrieve to prefer decision logs for decision questions. Better: do not index them in v1. Non-goal it. The knowledge owner will thank you when the bot stops quoting a joke from standup as a rule.

Eval questions written by the builder are too kind. Sit with three actual users and harvest questions from their last week of Slack. That set will hurt. Good. Demo-only evals are how you get 90% on the slide and 40% on Monday. Put 'eval set source: builders vs users' on the RAID. Trigger: more than half the questions originated in the demo script.

Junk also includes secrets that should never have been in the wiki: keys, customer lists, pastes from ticketing. Ingest is a chance to detect and drop, not a chance to vectorize a password. If you find secrets, you rotate them and you tell security. You do not 'just skip that page' quietly. The page is still in the wiki, and the next connector will find it.

A chunk quality gate is allowed: drop chunks below N characters, drop chunks that are >80% boilerplate, flag chunks with no heading. You will over-drop at first. That is the correct direction, same as ACL over-block. Adding a page back is easy. Explaining why the bot cited 'Skip to content' is not.

RAID this as: 'Index is fluent junk.' Impact: user distrust, steering mockery, silent wrong answers. Owner: knowledge owner on corpus hygiene, engineer on drop rules. Trigger: sample of 20 chunks fails review; cookie banner in a citation. Mitigation: sample gate before ingest scale-up, drop lists, OCR workstream or out-of-scope.

Fluent garbage is a sample-gate failure. Twenty chunks on a slide before ingest scale-up. Drop nav, cookies, empty scans, meeting notes with no decision if v1 cannot tag them. OCR is a workstream or it is out of scope — it is not hidden inside 'we'll embed Confluence.' Secrets found at ingest are rotated and reported, not quietly skipped. Builder-written evals are too kind; harvest from users. A chunk quality gate that over-drops is the correct direction, same as ACL over-block. Adding a page back is easy. Explaining why the bot cited 'Skip to content' in steering is not. Demand the sample. Fund ingest only after it passes. That one habit prevents a quarter of the catalog on this page.

The UI shows a source; the sentence came from the model's prior. Groundedness evals catch this. So does a 'click the source and see the highlight' UX. If you cannot highlight, you cannot claim citation. Theatre is worse than no citation because it trains users and auditors to trust the footnote. A missing footnote at least looks unfinished.

Models learn to sprinkle [S1] because you asked. They will sprinkle it on a sentence the chunk does not support. Claim-level eval, two columns: grounded, cited-right. A score that only checks 'did any source id appear' is how theatre gets a green dashboard. Require the id to match the chunk that holds the claim, or mark it fail.

Over-promise is the sponsor version of theatre. 'The bot will just know.' Your no-go memo exists to kill that sentence: we will not index personal drives, we will not answer HR case questions, we will not skip ACLs, we will not go live with recall@5 under the agreed bar, we will not RAG the ERP. Each 'will not' is a steering slide. People remember the demo. They need the memo in the same pack.

Helpful tone makes theatre worse. A refuse that sounds ashamed will be patched by a product manager into a guess. Keep the refuse sentence plain. Do not apologize the model into improvising. UX can offer 'ask a human' or 'request ingest' without offering a made-up clause.

Screenshot culture is part of the threat model. Users will paste the answer into a ticket as if it were policy. The footer 'this is not a decision' is not legal magic, but it is a speed bump and it is evidence you warned them. Combine it with citations that actually open. Combine it with an owner of wrong answers (who the user writes to). If nobody owns a wrong answer, every wrong answer becomes your personal incident.

Vendor claims ('grounded by design,' 'citations included') are not evals. Ask for the split numbers on your questions. If they will not run your 10-question table, they are not ready, or they know something about their retrieve they do not want on a slide. Either way you run the eval.

RAID this as: 'UI cites sources that do not support the sentence.' Impact: false trust, audit failure, possible customer commitment on invented policy. Owner: you on eval, engineer on highlight UX, product on footer. Trigger: groundedness or citation-correctness below bar on the frozen set. Mitigation: claim-level eval, highlight-or-no-cite rule, refuse sentence frozen, no-go if bar not met.

Citation theatre is a footer that does not support the sentence. Catch it with claim-level groundedness, a cited-right column, and highlight-or-no-cite. A score that only checks whether any source id appeared is how theatre gets a green dashboard. Helpful tone makes it worse; keep refuse plain. Screenshot culture means users will paste the answer as policy — footer, real citations, and an owner of wrong answers are the speed bumps. Vendor 'grounded by design' is not your eval. Over-promise is the sponsor version of theatre; the no-go memo exists to kill 'the bot will just know.' If you cannot highlight, you cannot claim citation. If you claim it anyway, you trained the auditor.

Saying no is the job. The form is a short memo, not a fight. Six sentences is enough: what was asked, why it is not ready, the conditions to proceed, the thinner slice you will do instead, who owns the corpus, when you re-evaluate. Calm. Specific. No adjectives about 'reckless' or 'transformational.' Steering can hear this. They cannot hear a rant.

What was asked: 'Index all of Confluence in two weeks and demo to the CEO.' Why not: no knowledge owner, ACLs would be stripped or ignored to hit the date, no user-written eval, ingest would include HR-adjacent spaces, re-index SLA unnamed, citation UX would be a filename footer. You do not need all of those to be true. Two are enough to no-go. List the ones that are true.

Conditions to proceed: named owner, ACLs on, one space, sample of 20 chunks reviewed, 40 eval questions harvested from real PMs (10 is the design floor; 40 is a live bar), recall@5 at agreed number, groundedness on 20 answers, refuse path visible, retention and logging signed by Legal. This is not bureaucracy. This is the thinnest set that prevents the catalog above.

Thinner slice: Atlas space, SOPs + decision log + RAID, PMs only, read-only, citations that open H2, 24h lag printed, no personal drives, no finance folders, no writes. Demo to the sponsor of Atlas, not to the CEO, until the eval bar holds for two weeks. The slice should still be impressive if the wiki is real. If the only impressive demo is 'everything,' the corpus is the problem.

Who owns the corpus: a named role, not 'the PMO.' If you cannot name them, that is row 9 in the RAID and it is sufficient to no-go by itself. Unowned wikis do not become owned because you added vectors. They become higher-confidence unowned wikis.

When you re-evaluate: a date. Conditions are either met or they are not. Do not leave a floating 'when ingest is ready.' Ready means the conditions. Dates make owners move. Floating readiness makes you the blocker in other people's stories.

Tone: you are protecting the sponsor from a screenshot. You are not blocking innovation. Offer the slice in the same memo so the energy has a place to go. People who only say no get routed around. People who say 'not this; this, by this date, with these gates' stay in the room.

The no-go memo is six sentences: what was asked, why not, conditions to proceed, thinner slice, named owner, re-evaluate date. Calm. Specific. No adjectives. Offer the slice in the same memo so the energy has a place to go. People who only say no get routed around. People who say 'not this; this, by this date, with these gates' stay in the room. If you cannot name the knowledge owner, that alone is sufficient to no-go. Unowned wikis do not become owned because you added vectors. They become higher-confidence unowned wikis. Write the memo as if you will send it. You will, or you will wish you had. Keep it for day 21 and for interviews. People who have been burned by a wiki bot will recognize it. That is the point of the day.

The practice wants eight rows. Use the catalog: stale docs, ACL, junk chunks, conflicting SOPs, no owner, demo-only eval, citation theatre, cost at 10×. Each row: statement, impact, owner, trigger, mitigation. Triggers are observable (canary lag, leak-test fail, sample-chunk review fail, recall@5 drop, spend > envelope). If the trigger is 'we'll know it when we see it,' you wrote a worry, not a RAID item.

Cost at 10× belongs even if the POC is tiny. Embed plus generate plus re-embed on churn. A busy wiki re-indexed on every save can cost more than chat. Put a cap and a kill switch (day 9) in the same row. Finance will not be kinder because the spend was 'just tokens.'

Ownership model: knowledge owner (corpus current, in-scope, conflicts archived), platform owner (index, SLA, ACLs as implemented), delivery lead (evals, go-live, RAID), security (permission model, leak test), Legal (logs, retention). Write the names. If two boxes share a name, fine. If a box has no name, that box is the no-go.

Wrong-answer ownership is a row people skip. When the bot is wrong, who does the user tell, who patches the corpus or the prompt, in what SLA. If the answer is 'file a ticket to the AI team,' you will drown and the corpus will not improve. Route corpus errors to the knowledge owner. Route product errors to you. Publish that.

Re-index runbook: connector health probe, canary document, lag banner, what we do if Confluence API rate-limits, what we do if embedder is down (serve stale with banner vs go dark). Dark is allowed. Silent stale is not. Pick per corpus class.

You will reuse this RAID on day 14 and day 21. Write it as if someone else has to run it next quarter. That is the quality bar. Cute shorthand ('ACL!!') is not a row.

If the program still wants the CEO demo on the original date, the memo plus the RAID is what you send. You do not quietly strip ACLs to be a team player. That is the whole day.

Eight RAID rows, triggers you can observe, owners as hats, a re-index runbook, a wrong-answer route that does not dump every complaint on 'the AI team,' and cost at 10x with a kill switch. If the trigger is 'we'll know it when we see it,' you wrote a worry. If a box has no name, that box is the no-go. You will reuse this RAID on day 14 and day 21. Write it as if someone else has to run it next quarter. Cute shorthand is not a row. If the program still wants the CEO demo on the original date, the memo plus the RAID is what you send. You do not quietly strip ACLs to be a team player. That sentence is the whole day, and it is the reason a delivery manager is in this workstream at all.