RAG governance for regulated industries: evals, guardrails, and the boring parts that matter

Retrieval permissions are an access-control problem

If a document is restricted to one campus, its chunks must be restricted to one campus. Filtering after retrieval is a leak waiting for a prompt-injection test to find it. Apply the permission filter inside the query, derived from the caller's session, never from anything the user typed.

Index the permission at write time. Recomputing it at read time is where the bugs live.

Freshness is policy, not a cron job

Every source needs a stated maximum staleness and a visible last-indexed timestamp. When a policy document supersedes another, the old version must leave the index in the same transaction — otherwise the model cites both and confidently averages them.

Evals: golden sets, regression gates, and refusals

We ship an eval harness before we ship the agent. Typically 200–400 golden questions written by the people who currently answer them, each with a cited expected source.

Two gates in CI: accuracy against the golden set, and a refusal set the model must decline. For the K-12 network, any question about a specific fee amount had to come from the ledger or be refused — the model was never allowed to compute money.

A regression gate that blocks deployment is the difference between a governed system and a demo with a changelog.

Guardrails that survive an audit

PII redaction before the model call, not after. Refusal policy written in the same document as the escalation path. Confidence-based handoff with the full transcript attached to the human ticket.

Log the retrieved chunk IDs and the model version with every answer. Six months later, that log is the only way to reconstruct a disputed response.

The boring parts

Data residency, retention windows, per-request cost and latency budgets, and a named owner for the index. These are the questions legal asks two weeks before go-live. Answer them in week one and the launch date stops moving.