Project Detail
Searchable RAG Copilot
An enterprise knowledge retrieval system with a shared FastAPI RAG engine, dual clients (Streamlit & Microsoft Teams), pre-retrieval access control, and a swappable local/Azure hybrid architecture.
The Problem
Enterprises store operational policies, technical manuals, and sensitive HR/IT documents across disconnected silos (OneDrive, OneNote, PDFs, and file shares). Traditional keyword search returns documents rather than answers, while generic RAG chatbots create data-leakage risks when sensitive documents lack access control. The objective was to build a secure retrieval system that enforces strict Access Control Lists (ACLs) and department boundaries before any context is passed to the language model.
What I Built
An end-to-end enterprise knowledge retrieval platform featuring a shared FastAPI backend that powers two separate interfaces: an administrative & employee Streamlit portal and a Microsoft Teams bot built with Microsoft 365 Agents Toolkit. The system supports a dual runtime profile (fully local via ChromaDB + Ollama/Mistral, or hybrid cloud via Azure Blob + Azure AI Search + Azure OpenAI), automated document ingestion with OCR, SHA-based versioning with automatic archive cycles, Microsoft Graph connectors for OneDrive/OneNote, and a pre-retrieval authorization layer that guarantees unauthorized document chunks never reach the LLM.
Screenshots & Artifacts
Tech Stack
Decisions I Made
Enforced pre-retrieval access control: Applied user role and department ACL filtering in SQLite before vector retrieval, ensuring unauthorized context never enters prompt memory or reaches the LLM.
Designed a swappable dual-profile runtime: Decoupled vector stores (Chroma vs Azure AI Search) and LLM providers (Ollama/Mistral vs Azure OpenAI) behind clean adapter abstractions so developers can test locally at zero cloud cost or deploy to Azure using only configuration flags.
Engineered a single shared backend for dual clients: Built FastAPI as the central orchestration brain serving both an administrative Streamlit web portal and an employee-facing Microsoft Teams bot over shared HTTP contracts.
Implemented deterministic SHA content hashing and versioning: Tracked document lifecycle so re-uploaded documents archive prior versions and clean up obsolete vector records while retaining historical audit logs.
Established a staged connector review queue: Required discovered Microsoft Graph items (OneDrive/OneNote) to undergo an admin metadata and ACL verification step before being chunked and indexed into search.
Built automated retrieval evaluation & AI Advisor: Created a labelled benchmark query suite to evaluate accuracy, hit rate, and latency, combined with a rule-based AI Advisor to detect knowledge gaps and unindexed queries.
What I Learned
Retrieval pipeline design dominates LLM parameter size: Chunking strategies, semantic similarity thresholds, metadata tagging, and embedding quality impact answer fidelity and hallucination reduction far more than model choice alone.
Security must live at the data and query layers: LLMs cannot be trusted to self-police authorization; permissions must be strictly verified deterministically prior to retrieval.
Decoupling data governance from vector search: Maintaining SQLite as the single source of truth for metadata, ACLs, version lineage, and query audit logs made switching vector stores and cloud providers straightforward.
Defensive AI design: Implemented strict citation requirements and fallback handling to gracefully return 'information not found' rather than letting the model speculate.
Handling real-world enterprise ingestion: Handled multi-format documents (PDF, DOCX, TXT) with OCR fallbacks, managing inconsistent formatting, tables, and scanned pages in enterprise data.