Secure RAG with RBAC, Guardrails & Monitoring
Enterprise RAG with RBAC metadata pushed into the vector-search filter, PII masking before generation, and Ragas scoring on every change.
Use case
The problem space.
Answer from private corpora while guaranteeing a caller can retrieve only what their role permits — enforced at the retrieval filter, not the prompt.
What's implemented
Built with intention.
Permission-aware retrieval01
RBAC metadata is applied to the retrieval filter so vector search respects the caller's organisational scope.
Ingestion and protection02
Docling prepares source documents; guardrails mask PII and detect out-of-scope or unsafe requests before generation.
Quality feedback loop03
Ragas-based monitoring evaluates retrieval relevance and response quality so regressions are visible and actionable.
Architecture
Systems in concert.
The primary request and data paths, presented as a compact operating model.
A conceptual architecture for communicating the system design and operational responsibilities.
Step by step
From zero to
running.
Representative local-development commands that show the implementation path and operating sequence.
- 01
Start the knowledge services
Run the vector store and database containers and configure the model provider in the environment file.
docker compose up -d qdrant postgres cp .env.example .env - 02
Ingest approved sources
Parse documents into chunks, attach ACL metadata, then create or refresh vector embeddings.
python -m app.ingest ./documents --collection knowledge-base - 03
Launch the workspace
Start the Streamlit interface and authenticate with a user role to verify scoped retrieval.
streamlit run app/ui.py - 04
Measure quality
Run the evaluation suite and review relevance, faithfulness, and guardrail outcomes before releasing changes.
python -m evals.ragas --dataset evals/golden.json