A document can't be retrieved just because it matches a query. It has to be approved, cleaned, non-expired, and non-CUI first — and that check is a database rule, not a setting. Search the corpus and watch what gets surfaced and what gets refused.
Surfaced to the model
Refused by governance
Why this is different. In NGOS, "RAG-eligible" is a generated column in the database: a document qualifies only if it is approved (or executive-approved), cleaned, not CUI, and not expired. Retrieval reads an eligibility view, so an unapproved draft, an expired rate sheet, or a CUI file physically cannot reach the model — even when it's the best keyword match. Governance isn't a filter an engineer has to remember to apply; it's built into where the data lives.