Cargando el Technology Radar
Governed RAG with hybrid search combines semantic vector retrieval, keyword retrieval, reranking, source permissions, citations, and observability so enterprise assistants answer from authorized and relevant content. Azure AI Search describes RAG as grounding LLM responses in proprietary content and identifies security and governance, multi-source access, token constraints, and response-time expectations as core RAG challenges (Microsoft Learn).
Hybrid retrieval is the default baseline because vector search and keyword search fail in different ways. Azure defines hybrid search as parallel keyword and vector queries whose results are unified, while AWS Bedrock Knowledge Bases describes hybrid search as combining semantic search with keyword-based search to improve relevance and cover exact entities such as product names, colors, prices, and specific identifiers (Microsoft Learn, AWS Machine Learning Blog).
The “governed” part is the differentiator. Enterprise RAG must preserve source permissions, trim results at query time, log grounding data and citations, evaluate retrieval quality, and keep content fresh. Azure AI Search supports document-level security trimming and token-based permission checks so result sets include only documents the user is authorized to access (Microsoft Learn).
HYBRID or SEMANTIC, and returns retrieved chunks, source location, and relevance scores through the Retrieve API (AWS Machine Learning Blog).Hybrid search improves recall but adds tuning complexity. Teams must decide chunking strategy, keyword/vector weighting, top-k limits, semantic ranking, reranking, metadata filters, source boosts, and freshness rules.
Permission-aware retrieval is easy to claim and hard to implement. If access control happens only in the UI or after generation, the LLM may already have seen unauthorized context. Query-time enforcement needs preserved ACLs, group expansion, token validation, and audit logs (Microsoft Learn).
Connectors and content quality often dominate model quality. Stale indexes, lossy document extraction, poor PDF parsing, missing metadata, bad chunk boundaries, and incomplete permissions can make a strong model produce weak or unsafe answers.
RAG evaluation is a continuous system obligation. Retrieval quality, citation correctness, answer faithfulness, latency, cost, and access-control leakage need regression tests whenever embeddings, chunkers, prompts, rerankers, permissions, or source connectors change.
Adopt governed hybrid retrieval as the default for enterprise search and LLM answers. Use vector search for semantic match, keyword search for exact entities and rare terms, reranking for final ordering, and permission-aware retrieval for source-aligned access control.
Treat RAG as a governed data product, not a prompt pattern. Require document-level authorization, source citations, retrieval logs, freshness SLAs, connector health checks, eval datasets, and red-team tests for permission leakage and hallucinated citations before broad rollout.