Retrieval-Augmented Generation (RAG)
Retrieval-Augmented Generation (RAG) is an architecture that combines an LLM with a retrieval system, grounding the model's outputs in documents fetched from an external source at inference time.
What RAG Solves
LLMs trained on general data do not know an organization's specific documents, policies, or knowledge. RAG solves this by retrieving relevant documents from an external source (a vector database, a document store, a search index) and providing them to the LLM as context when generating a response.
RAG reduces hallucinations by grounding outputs in retrieved sources, enables use of proprietary data without retraining the model, and lets updates propagate quickly (updating the retrieval source updates the effective knowledge of the system).
Governance Concerns Specific to RAG
RAG introduces its own risk categories. The retrieval source becomes an extension of the AI system's data access; if it contains sensitive information, that information can appear in outputs. Retrieval sources can be poisoned to affect specific queries. RAG outputs can inadvertently expose data from documents the user should not have been able to access.
See AI data governance for the framework governance approach and AI data leakage for the exposure paths.
RAG in Enterprise AI Programs
Effective governance treats RAG systems as distinct assets in the AI asset inventory, documents retrieval sources and their sensitivity, applies access controls consistently between the retrieval layer and downstream users, and monitors outputs for inadvertent exposure of retrieved content.
Related Terms
Full AI Visibility. Full Control. One Connected Platform.
Enterprise AI is expanding faster than most governance programs can track. Kovrr connects every AI signal across browser, endpoint, network, identity, and vendor systems into a single platform so security, governance, and risk teams work from the same evidence.
