RAG Formation · Reference

Metadata, filters, and access boundaries

A standalone cheat sheet for learning and testing RAG quality on this site.

$ reference --status
▸ course RAG Formation
▸ mode standalone reference
▸ status Complete
● learn → test → verify

Reference sheet

Metadata, filters, and access boundaries

The guided RAG Formation course content is complete; this reference is available for self-directed practice.

One-line rule

A field becomes an access boundary only when the server applies it to the requesting user before retrieval.

Status labels

Status	Meaning
Implemented	Server code enforces the rule before retrieval.
Metadata available	The document field exists, but there is no proven rule connecting the user to a filter.
Proposed	The rule still needs a field, policy, enforcement point, and negative test.

Demo inventory

The current demo ingestion provides the company, department, document type, and document reference. On its own, it does not provide a user role, user department, supplier scope, classification, or authorization policy.

Negative test frame

Given a supplier identity and a QA-only procedure, when that identity runs a search, then the QA procedure should be missing from the retrieval results and blocked from answer generation. A server-side filter has to be wired into all four searches independently (Qdrant chunks, Qdrant summaries, Meilisearch, LightRAG) — each is a separate function call with no shared filter layer, so a filter added to one and forgotten in another is a real leak, not a hypothetical.

Local pointers

demo/metadata_lab.py
demo/setup_demo.py
reports/lesson-07-metadata-inventory.md

Continue learning: Open the matching standalone lesson · Course roadmap