RAG engineering

Authorization participates in retrieval; it is not a post-filter.

The Knowledge Assistant is deliberately separate from critical ticket processing until retrieval quality is measured.

Question → grounded answer

click a stage

Identity. NestJS authenticates the user and derives tenant, branch and role context server-side.

Ingestion

Admin upload → NestJS authorization → immutable document version → outbox
→ n8n → FastAPI parse → deterministic chunks → embeddings → pgvector
→ version READY → active-version pointer

Access rule

The vector query includes organization, branch scope and role overlap in its WHERE clause before ORDER BY embedding <=> query_embedding. A Branch A user therefore cannot have a Branch B chunk retrieved and then hidden later—the Branch B chunk never enters the ranking candidate set.

Evaluation

The repository ships a deterministic 20-question offline regression set covering expected-source retrieval, branch leakage, support/admin visibility and abstention. It is a development regression set, not evidence of production accuracy.