Six years after Lewis and co-authors published their paper on retrieval-augmented generation, nobody is writing a grant application to ask whether a model can be wired up to your own documents. RAG sits in every major stack, in every vendor pitch and in every pilot meant to "answer from the knowledge base." That's good news for timelines and bad news for advantage: once a technique becomes plumbing, it stops being the reason anyone picks you. Enterprise RAG is no longer the research question "can we ground a model in our own content." It's an operational one: can you prove where an answer came from, and will your index still be true in six months?
In our note on governed agents we argued that the deployments which survive in production are the ones where data classification, human oversight and the audit trail are part of the runtime, not a document glued on after an incident. The knowledge base is where that argument gets tested fastest — because it is the thing that hands the model the content on which the model then bases a sentence sent to your customer.
What actually changed
In 2020 the question was whether you could give a model an external memory so it answers from documents rather than from weights. "Yes, you can" is now a default feature of tools your team already pays for. That moves the point at which risk appears. When building a RAG knowledge system took a quarter, all the attention went into making retrieval work at all. When it takes an afternoon, the attention goes nowhere — the system gets built with no owner, no review date and no answer to the question of who will notice it has gone stale.
A citation is not evidence
The strongest signal this year isn't about retrieval quality but about citation quality. In a study published in May 2026 ("Cited but Not Verified") the authors examined what actually sits behind the citations that deep research agents generate. The links mostly work — above 94% for the strongest models — but whether the claim is actually supported by the cited source lands in the 39–77% range, depending on the model. They also noted that accuracy falls as the number of tool calls grows: the deeper the agent "researches," the worse it guards its sources.
Let's be explicit about scope, because it isn't the same setting: the study covers deep research agents on the open web, not your in-house RAG, so carrying those numbers over to your deployment would be an overreach. The mechanism, though, is the same, and the mechanism is what matters here. A footnote in the interface is not an audit trail — it is an interface element that looks like evidence. Evidence is a record stating which chunk of which version of a document reached the model, and when, reproducible after the fact once the document itself has changed.
The index rots quietly
The second thing nobody plans for: an index has no expiry date, so nobody watches one. Policies, price lists, procedures and notes go in, and then the organization carries on — documents get edited, superseded, withdrawn. If nobody owns removal, the model receives both versions of the same rule and picks whichever fits the question better. The result doesn't look like a demo hallucination. It looks like a confident answer citing an internal document that stopped being valid two years ago. The organization starts making up its own history, in its own words from years back.
The fix is dull. An index needs an owner — a person, not a team — and a removal path that fires together with a document's withdrawal, not at the next big clean-up. Plus a date on the answer, an "as of," so whoever asked can see how old the material under that sentence really is.
Access control is part of the answer
An index is a copy of your document repository, only flattened. The permissions that govern who sees what on a shared drive or in SharePoint do not carry over to vectors on their own. If the permission filter doesn't run at query time, the knowledge system becomes a channel through which content from a closed folder reaches someone without access — leaving no trace, because formally nobody opened anything. Gluing a rule into the prompt ("never disclose HR data") is not access control. Access control happens before retrieval and decides what may enter this particular person's context in the first place.
What this means for a fund, a large organization and a mid-sized company
Fund (PE). "We have RAG" has stopped being an answer about technological advantage — in due diligence it now weighs about as much as "we have a website." The questions that reveal something are narrower: who owns the index, what happens when a document is withdrawn, and whether you can reconstruct after the fact what a specific answer was based on. A knowledge base with no way to point at the provenance of an answer isn't an asset; in a regulated industry it's a line a buyer will deduct from the price.
Large organization. The advantage has moved from retrieval to governance and maintenance, and that's good news, because both can be done without switching model vendor. The order is the same as with agents: classify content before it enters the index, filter permissions at query time, keep a decision log that survives a document change. That's exactly how we set up knowledge systems — starting from what may enter the context, not from the choice of vector database.
Mid-sized company. You don't need an AI governance program to close this. You need one person who knows what's in the index, one removal rule, and an answer that shows its source together with that source's date. If your internal assistant answers staff questions about price lists or procedures, those are the whole difference between a tool and a risk — and an afternoon's work, not a quarter's.
One question for this week
Take one question your knowledge system answers well, and ask it for the source. Then check two things: whether the cited document is still valid, and whether the person who asked was entitled to see it. If either answer is "I don't know," you have an item for the next review, not a line on the roadmap. Describe your case: mailto:[email protected]?subject=Rozmowa%20z%20Aurora%20AI.