Innomerc Choose your depth. Learn at your own pace.
Understand it
Retrieval-augmented generation gives a language model relevant information at the time it answers. The system searches a collection, selects useful passages and includes them with the question. This can ground an answer in documents that were not part of the model’s training.
Cedar’s support assistant retrieves an approved product guide before explaining a setting. Finding a passage does not guarantee a correct answer: the passage may be outdated, irrelevant or misinterpreted. A useful answer points back to evidence.
Under the hood
A common pipeline splits documents into chunks, indexes them and retrieves candidate passages for a query. Embeddings represent similarity, while keyword or hybrid retrieval can add other signals. Reranking may improve selection before context is assembled.
Access controls must filter retrieval according to the requesting user. Similarity is not permission. Keep document identity, version and provenance through the pipeline so an answer can cite its actual source rather than a guessed reference.
Practitioner perspective
Evaluate retrieval quality separately from answer quality. Test whether the correct evidence is found, whether the answer is supported and whether unauthorized documents are excluded. A model can produce a plausible answer from irrelevant context.
Retrieved documents are untrusted data, not instructions with authority over the assistant. Poisoned content can try to alter behavior. Restrict downstream tools independently and assess data leakage, indexing permissions, deletion propagation and document freshness.
RAG
Retrieval-augmented generation gives a language model relevant information at the time it answers. The system searches a collection, selects useful passages and includes them with the question. This can ground an answer in documents that were not part of the model’s training.
Illustrated analogy · Select the image to enlargeWatch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
Retrieval before generation
Track which documents enter the model’s context.
Only permitted evidence should enter model context.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- User question
The request a person wants the system to answer.
Example: An employee asks about the leave policy.
- Access filter
A check that limits which information a user is permitted to retrieve.
Example: A staff member should not receive restricted payroll documents in search results.
- Document store
Storage containing documents the application may search.
Example: An approved handbook provides context for an answer.
- Model
An AI system that generates output from its input. Its answer can be wrong.
Example: It drafts an answer using the question and supplied context.
Authorized retrieval
Only permitted evidence should enter model context.
- User question Access filter: Question + identity. Bind retrieval to trusted user context.
- Access filter Document store: Allowed search. Search within the permitted corpus.
- Document store Model: Scoped context. Pass retrieved evidence alongside the task.
- Model User question: Answer + sources. The model responds; cited claims still need evaluation.
Restricted document
A model instruction cannot repair a document leak that already happened.
- User question Access filter: Question. Evaluate the caller’s document permissions.
- Document store Access filter: Restricted result. The candidate record fails access policy.
- Access filter Model: Permitted context only. Exclude the restricted text before generation.
- Model User question: Bounded answer. Respond using allowed evidence or state insufficient information.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Question
The user asks how a fictional product setting works.
Read every step without animation
Grounded question
- Question. The user asks how a fictional product setting works.
- Authorized retrieval. Search is restricted to documents this user may read.
- Relevant passages. The retriever selects evidence and retains source identifiers.
- Model context. Question and passages are provided with clear boundaries.
- Answer + sources. The assistant produces an answer that can be checked against evidence.
Retrieval supplies context; verification still matters.
Untrusted passage
- Question. The user asks the same product question.
- Retrieved content. One passage includes an unrelated instruction.
- Trust boundary. Document content is treated as data, not permission.
- Restricted action. No additional tool authority is created by the passage.
Documents can inform answers without controlling the system.
Explore deeper: additional experiment
Which document reaches the model?
The retriever includes this document for this user. Retrieved text remains untrusted evidence, not an instruction to bypass policy.
A local teaching model with fictional inputs. It does not test a live system.
Attack view
A retrieved passage contains an instruction unrelated to the user’s question. The secure design treats that passage as source material and prevents it from granting tool permissions.
Defender view
- Enforce access policy before placing passages in model context.
- Preserve source identity and evaluate answers against evidence.
- Treat retrieved instructions as untrusted and constrain any tools outside the model.
Common mistakes
- RAG is not the same as retraining the model.
- A vector similarity score is not a truth or authorization score.
Check your understanding
Active recall: explain this idea in 30 seconds
Retrieval-augmented generation gives a language model relevant information at the time it answers. The system searches a collection, selects useful passages and includes them with the question. This can ground an answer in documents that were not part of the model’s training.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
- Microsoft: Retrieval-augmented generation overview
- OWASP: Vector and Embedding Weaknesses (2025 reference)
- OWASP GenAI LLM Top 10 2026 announcement
Content reviewed 2026-09-10. Read the editorial policy.