惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Apple Machine Learning Research
Apple Machine Learning Research
AWS News Blog
AWS News Blog
Google DeepMind News
Google DeepMind News
U
Unit 42
博客园 - 叶小钗
博客园 - 聂微东
GbyAI
GbyAI
Stack Overflow Blog
Stack Overflow Blog
有赞技术团队
有赞技术团队
aimingoo的专栏
aimingoo的专栏
D
DataBreaches.Net
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
Jina AI
Jina AI
美团技术团队
The Cloudflare Blog
M
MIT News - Artificial intelligence
Microsoft Azure Blog
Microsoft Azure Blog
I
InfoQ
S
Schneier on Security
C
Check Point Blog
Project Zero
Project Zero
The Hacker News
The Hacker News
Scott Helme
Scott Helme
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
Cisco Talos Blog
Cisco Talos Blog
P
Privacy International News Feed
SecWiki News
SecWiki News
Latest news
Latest news
MongoDB | Blog
MongoDB | Blog
S
Secure Thoughts
Google Online Security Blog
Google Online Security Blog
F
Fortinet All Blogs
博客园 - 三生石上(FineUI控件)
H
Help Net Security
TaoSecurity Blog
TaoSecurity Blog
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Last Week in AI
Last Week in AI
P
Privacy & Cybersecurity Law Blog
Forbes - Security
Forbes - Security
G
GRAHAM CLULEY
N
Netflix TechBlog - Medium
L
Lohrmann on Cybersecurity
A
About on SuperTechFans
T
The Exploit Database - CXSecurity.com
C
Cisco Blogs
PCI Perspectives
PCI Perspectives
大猫的无限游戏
大猫的无限游戏
T
Troy Hunt's Blog
H
Hacker News: Front Page
Vercel News
Vercel News

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
How to Build a RAG Pipeline for an Enterprise Knowledge Base That Actually Works in Production
Open Craft · 2026-06-20 · via DEV Community

Retrieval-Augmented Generation (RAG) — a pattern where a language model answers questions by first pulling relevant document chunks from a search index, then generating a response grounded in those chunks — is not magic. It is an engineering discipline, and it fails in predictable ways when teams skip the architecture decisions that make retrieval honest. This article covers those decisions: where keyword search breaks down, how to design an ingestion pipeline that holds up under real enterprise corpora, and how to audit retrieval accuracy before you ship anything to users.


Why Keyword Search Fails Enterprise Knowledge Bases

Keyword search matches tokens. A query for "equipment return policy after contract termination" will miss a document titled "offboarding asset collection procedures" even if both describe the same process. For small corpora — a hundred documents, stable vocabulary — this gap is tolerable. For an enterprise knowledge base with hundreds of contributors, inconsistent terminology, and documents spanning five years of policy drift, it becomes a structural failure mode.

Vector search solves this by encoding meaning, not tokens. A dense vector embedding maps a sentence into a high-dimensional space where semantically similar text lands close together, regardless of surface wording. The tradeoff: vector search can over-retrieve. It will surface plausible-sounding documents that are not actually relevant because the embedding model generalizes too aggressively.

The production-grade answer is a hybrid retrieval layer: run both keyword (sparse) and vector (dense) retrieval in parallel, then merge the ranked lists using a reciprocal rank fusion algorithm before passing candidates to the language model. This is not a novel idea — the IR research community has used fusion techniques for years under the label "hybrid retrieval." What is new is that most managed vector databases (Pinecone, Qdrant, Weaviate, and others) now expose this as a first-class option, which removes the excuse for deploying pure vector search alone.

One honest caveat: hybrid retrieval adds operational complexity. You are now maintaining two index types, and tuning their relative weights for your specific corpus takes real evaluation work. Do not add it reflexively. Add it when you have measured evidence that either mode alone is failing.


How Do You Design an Ingestion Pipeline That Preserves Document Structure?

The ingestion pipeline is where most enterprise RAG systems quietly break. Teams chunk by fixed token count, generate embeddings, write to a vector store, and call it done. Then retrieval returns fragments that begin mid-sentence and end before the relevant clause, and the language model hallucinates to fill the gap.

A better ingestion design makes three deliberate choices:

Chunking strategy. Fixed-size chunking with overlap (e.g., 512 tokens with a 64-token overlap) is a reasonable baseline but not always correct. For structured documents — policy manuals, HR handbooks, technical runbooks — hierarchical chunking works better: keep the parent section intact as a "parent chunk" for context retrieval, and index smaller "child chunks" for precision. The LlamaIndex documentation calls this "small-to-big retrieval" and it is worth reading directly. When a child chunk retrieves, you pass the parent chunk to the model — you get precision on the search side and coherence on the generation side.

Embedding model selection. Do not default to whatever the vector database's hosted embedding suggests. Evaluate on your domain. A general-purpose embedding model trained on web text will underperform on dense technical or legal language. MTEB (Massive Text Embedding Benchmark) publishes ranked evaluations across domain types and is a legitimate starting point for shortlisting candidates. Pick two or three, run them against a held-out sample of your actual documents, and measure recall at k=5 before committing.

Vector database schema. Each chunk record needs more than the text and its vector. At minimum: source document ID, page or section reference, document creation date, content type (policy vs. procedure vs. FAQ), and access tier if your organization has document-level permissions. This metadata is not cosmetic — it is what enables the filtering and auditing steps that follow.

For teams concerned about long-term flexibility here, model neutrality in your AI infrastructure design is worth thinking through before you standardize on a single embedding provider.


Metadata Tagging Strategies for Enterprise Corpora

Metadata is retrieval infrastructure, not administrative overhead. A vector similarity score tells you a chunk is semantically close to a query; metadata filters tell you whether that chunk is applicable — current, from the right department, visible to the requesting user.

The tagging taxonomy for most enterprise corpora should cover at least these dimensions:

Metadata Field Purpose Example Values
doc_type Filter retrieval by content category policy, procedure, FAQ, contract
department Scope queries to relevant business unit HR, Legal, IT, Finance
effective_date Exclude superseded documents 2024-01-15
access_tier Enforce document-level permissions public, internal, restricted
language Route multilingual queries correctly en, id, ja
version_status Surface only current versions current, archived, draft

The practical challenge is populating this metadata at ingestion time. For well-managed document systems (SharePoint with enforced metadata, a structured CMS), you can extract most fields programmatically. For the more common case — a sprawling mix of PDFs, Word files, and wiki exports with inconsistent naming — you need a classification step in the ingestion pipeline. A lightweight classifier (even a small fine-tuned model or a structured prompt against a capable model) can assign doc_type and department with enough reliability to be useful, as long as you build a review queue for low-confidence classifications rather than auto-publishing them.

Never treat metadata as a set-and-forget step. As documents are updated, the metadata must be versioned alongside them. A stale effective_date on an archived policy is not a minor inconvenience — it is a liability if a user receives outdated guidance presented with apparent confidence.


How Do You Run Verifiable Retrieval Audits Before Deploying to Users?

Evaluating a RAG system is not the same as evaluating a language model. The model's generation quality is downstream of retrieval quality: if the wrong chunks are retrieved, no amount of prompt engineering fixes the answer. Retrieval audits must be a distinct, structured step before any deployment decision.

A practical audit process looks like this:

Step 1: Build a ground-truth evaluation set. Take 50–100 real questions that your knowledge base should answer — drawn from support tickets, HR inquiry logs, or stakeholder interviews — and manually identify the correct source documents for each. This is the only reliable way to know what "correct retrieval" looks like for your corpus.

Step 2: Run retrieval and score recall@k. For each evaluation question, run your retrieval pipeline and check whether the correct source document appears in the top k results (k=3 and k=5 are standard cutoffs). Recall@5 of around 0.80 or above is a reasonable minimum threshold before moving to generation evaluation. Below that, the generation quality does not matter — fix the retrieval first.

Step 3: Audit failure modes by category. Low recall failures cluster in recognizable patterns: vocabulary mismatch (keyword search is failing), out-of-scope documents flooding results (metadata filtering is missing), or very short documents with low embedding signal (chunking is too aggressive). Categorizing failures before fixing them prevents you from solving the wrong problem.

Step 4: Evaluate answer grounding. Once retrieval passes your threshold, evaluate whether the model's answers are actually grounded in the retrieved chunks or are fabricating. The RAGAS framework (an open-source evaluation library) provides structured metrics for this — specifically "faithfulness" and "answer relevance" — without requiring you to build custom evaluation tooling from scratch.

This is where RAG for an enterprise knowledge base earns its credibility or loses it. The evaluation step is not a QA formality; it is the mechanism that separates a working product from a demo that felt good in the boardroom. For a broader look at how this kind of discipline applies to operational AI workflows, the piece on AI workflow automation for operations teams covers the same principle across other automation surfaces.

If you are building this from scratch and want a reference implementation for the internal knowledge retrieval layer, the internal knowledge AI service overview describes the stack OpenCraft uses in production engagements.


FAQ

What is the difference between RAG and fine-tuning for an enterprise knowledge base?

RAG retrieves relevant documents at query time and passes them to the model as context. Fine-tuning bakes information into model weights during training. For enterprise knowledge bases, RAG is almost always the right choice: documents change, fine-tuning every update is impractical, and RAG provides source citations that make answers auditable. Fine-tuning is better suited to adjusting response style or domain-specific reasoning patterns.

How large does a document corpus need to be before RAG is worth the complexity?

There is no fixed threshold, but as a practical guide: if your knowledge base has more than a few hundred documents, inconsistent terminology across authors, or content that updates frequently, RAG pays for its complexity. Below that, a well-structured keyword search with a good UI often delivers more value with less operational overhead.

Which vector database should an enterprise team choose?

The decision depends on hosting constraints, existing infrastructure, and whether you need managed scaling. Qdrant and Weaviate both offer strong hybrid retrieval support and self-hosted options, which matters for data residency requirements. Pinecone is strong for managed, serverless deployments. Evaluate on your own query and corpus scale — benchmark numbers from vendor marketing are not a substitute for testing on your actual data.

How do you handle document permissions in a RAG system?

Enforce permissions at the retrieval layer through metadata filtering, not at the generation layer. If a user is not authorized to see a document, that document's chunks must be excluded from the retrieval candidate set before anything reaches the language model. Relying on the model to "not mention" restricted content is not a security control.

What should an enterprise do when retrieval quality degrades over time?

Corpus drift — new documents, updated policies, changing terminology — erodes retrieval performance incrementally. Build a scheduled re-evaluation job that runs your ground-truth query set against the live index at regular intervals. When recall@k drops below your threshold, trigger a re-chunking and re-embedding run on the affected document segments rather than waiting for user complaints.


A working RAG system for an enterprise knowledge base is not a product you install — it is an engineering decision stack you maintain. Get the ingestion pipeline right before you optimize prompts. Build the evaluation set before you demo to stakeholders. Every reliable knowledge base AI in production is built on retrieval discipline, not model capability alone. If you want a structured approach to that evaluation process, reach out to OpenCraft and we can walk through the audit framework with your actual corpus.


More from ocraft.id