Start with the corpus, not the model
Most disappointing retrieval results come from an unclear corpus: duplicated documents, outdated policy versions, and no single owner per document. We stabilise ownership and versioning before tuning any retrieval parameter.
Chunking strategy follows document structure. Policy documents, product specifications and support macros each retrieve better with different boundaries.
Permissions travel with the content
A knowledge system must never become a way around access control. Retrieval is filtered by the requesting user's permissions at query time, so a generated answer can only reference material that user is already allowed to read.
That constraint is enforced server-side. Client-side filtering of retrieved context is not treated as a security control.
Citations make the system reviewable
Every grounded answer carries its sources so a human can verify it. When retrieval confidence is low, the correct behaviour is to say so and route to a person — not to produce a fluent guess.