Designing Citation-Grounded RAG for Microsoft 365: Permissions, Retrieval, and Evidence
Enterprise permissions, hybrid search, and evaluation gates in Azure environments. How to keep SharePoint ACLs intact, fuse vector and keyword ranking, and abstain when evidence is weak.
Read architecture noteWhat this note covers
- Permissions-first ingest: Entra ID group ACLs travel with every chunk.
- Hybrid retrieval: pgvector plus BM25 merged with Reciprocal Rank Fusion.
- Evidence gates: Fail closed when top-k scores fall below threshold.