RAG with human release for sensitive work.

Retrieval-augmented generation is often sold as “chat over your documents.” For sensitive operational or matter work the harder design is the release boundary: which object classes may be retrieved, who may ask, what the retrieval set was, and who releases the answer before it touches a real ops or matter decision.

This piece is about RAG with human release for sensitive work — retrieval plus generation, held behind approval, before answers touch operational or matter data. It sits next to agents on Spectacle: agents propose; humans release; arithmetic stays in code. It is related to without approval the agent sleeps — cite that cousin for the general approval switch; do not republish it. This cut is RAG-specific: the retrieval set and the generated answer wait for human release before they touch sensitive objects.

What RAG is here (retrieval + generation)

Name the two halves before any production path:

1. Retrieval — Which store, index, or graph is queried? Which object classes are in scope (documents, matters, people, deadlines, operational records)? Who may run which query against which class?
2. Generation — The model writes language over the retrieved set. It does not invent arithmetic. It does not write sealed systems of record.

Together that is RAG. Without a named release step, “chat over docs” becomes silent disclosure of objects the operator never meant to surface.

Human release before answers touch sensitive objects

For sensitive work, release is not a polite UI toggle after the fact. It is the gate before a retrieved or generated answer may:

• enter an ops decision path,
• sit next to a matter or mandate object,
• leave a trust zone into email, ticket, or client-facing draft.

Who releases? A named human role — not the model, not an unattended agent loop. Agents on Spectacle may assemble a draft and name the retrieval set. Without release the draft stays asleep. See the live cousin on the approval switch; this piece adds the RAG surface: who may retrieve which object class, and what was retrieved.

Map release to objects from the operation. For sensitive paths, a case graph helps name the objects (sensitive data needs a case graph). Hosting choice alone is not the operation — models on STACKIT are not the operation (cite only).

Who may retrieve which object class

Before wiring an index:

• Class map — Documents vs matter files vs operational records vs logs. Not every class belongs in the same retriever.
• Role map — Who may query which class? Read vs propose vs act. Firm-wide knowledge vs mandate-scoped paths.
• Rights surface — RAG is a rights surface (Ben themes §3): grounding answers on company knowledge still needs citations and a named release of which classes may enter retrieval.
• No silent expand — Vector neighbours and graph expansion that pull extra objects into the retrieval set are still retrieval. They wait for the same release rules.

Audit the retrieval set

Sensitive RAG without an audit trail is theatre. Before release, the human should see:

• which objects (or object IDs / paths) entered the retrieval set,
• which filters or rights applied,
• which prompt and tool path produced the draft,
• that generation did not invent numbers the stack does not hold.

Arithmetic stays in code. The model only writes language. We do not invent hours, ROI, euros, or accuracy bands. We do not invent “GDPR-complete” or “§203-safe” labels for any RAG stack.

Distinct from graph-vs-vector and from the approval-switch cousin

This piece is not a remake of graph RAG versus vector RAG for business files — that compare is a separate Maggy LOCK day (still not live; do not link). Hybrid retrieval shapes can matter later; today’s cut is release before answers touch sensitive ops/matter data, whatever the retriever shape.

This piece is not a remake of the live approval-switch cousin. That cousin holds the general rule: without approval the agent sleeps. Here the surface is RAG: retrieval set + generated answer + human release before sensitive objects are touched.

What we are not selling

Not a named RAG SaaS or enterprise-search pitch. Not a sovereign-AI brand. Not a remake of live STACKIT or case-graph cousins. Not “AI for hospitality” or restaurant software. Not silent write-back to sealed systems. Not a claim that any retriever is “production-safe” or “GDPR-complete” by brand.

One core, every kind of business — one core, every operating type. Six sector bands equal. White-collar and ops paths use the same pattern — objects, retrieval rights, release — not a sector SKU. Venue last if named; no Gastgewerbe lead.

FAQ

What does RAG mean here?
Retrieval plus generation: query a named store of objects, then write language over that set — with human release before answers touch sensitive operational or matter data.

Is this the same as the approval-switch article?
Related, not the same. That cousin is the general switch. This piece is the RAG surface: who may retrieve which class, audit of the retrieval set, release before the answer touches sensitive work.

Do agents release answers on their own?
No. They propose. You release. Without approval the agent sleeps.

Do you invent compliance labels for RAG stacks?
No. Never invent “GDPR-complete” or “§203-safe” claims. Residency and hosting are not finished compliance.

Is this only for one sector?
No. Six bands equal. The pattern — object classes, retrieval rights, audit, human release — repeats wherever RAG sits near sensitive ops or matter objects.

Where should I start?
Spectacle. The Insights series is how we write about the operation.

CTA

If RAG is about to sit next to operational or matter objects and release is still unnamed — who may retrieve which class, what the retrieval set was, who releases the answer — request an initial analysis. Twenty minutes is enough to see whether retrieval and generation wait for human release before answers touch sensitive work. If the data cannot answer, we say so.