Vector Search to Grounded Context: Animate the Write and Query Paths

AI-assisted article. The demonstration uses labelled synthetic records and manually assigned vectors. It is not a semantic model, a production database or a benchmark.

A similar document can still be the wrong evidence

A vector search system finds nearby representations of information. An enterprise assistant needs something more specific: evidence the current user is permitted to read, concerning the correct business object and valid for the question being asked.

Consider an equipment assistant retrieving a maintenance policy. The closest text might belong to another division, describe an obsolete machine revision or be superseded. Similarity is useful for finding candidates. It does not establish permission, freshness or truth.

The write path creates searchable evidence

Begin with a permitted source and retain its identity. Extract text or other supported representations, divide it into meaningful units and generate embeddings using a selected model. An embedding is a numeric representation; its usefulness depends on the model, source material and task.

Store each chunk’s vector alongside enough metadata to locate the original material and enforce the retrieval policy. This might include tenant, document version, source URI and validity. Keep sensitive payloads subject to the same access and lifecycle rules as the originals.

Indexing makes search practical at scale. Some vector systems use approximate nearest-neighbour methods; this demonstration instead performs an exact scan over four synthetic records. The animation’s two-dimensional points are illustrative. Real embedding spaces typically have many more dimensions, and a two-dimensional display does not preserve all their relationships.

The embedding model and its version form part of the index contract. Do not silently mix incompatible vector spaces. A model migration needs a tested re-indexing strategy and a recovery plan.

The query path combines constraints and relevance

The application authenticates the caller and derives their access scope. The caller’s free-text question must not be able to choose another tenant or widen permission.

The question is embedded in the same compatible vector space. Eligible records are ranked by a selected similarity measure. Cosine similarity compares vector direction; it is not a calibrated probability that a document answers the question.

Metadata filtering can restrict eligible records before ranking or be integrated with search, depending on the engine. Applying a filter only after retrieving a tiny candidate set can miss valid results. Product documentation must be checked for the selected query behaviour.

Qdrant’s filtering documentation describes payload and identifier conditions. These mechanisms help implement constraints, but a database filter is not a complete authorisation system. The trusted application must supply and enforce the scope consistently.

After retrieval, the application may rerank candidates, inspect source freshness and assemble a bounded context. Return source references with the answer and allow an explicit ‘insufficient evidence’ result. A language model can still misread correct evidence or introduce unsupported claims.

Try the filter and inspect the numbers

The lab starts with an equipment-policy query vector. Its small corpus includes an active record in the selected division, a closer record in another division, an expired record and an unrelated active record. The tenant selector and validity checkbox change which candidates are eligible.

Change the query axis to see the ranking change. The table shows each record’s cosine score and whether it was excluded. Reset restores the initial state. Nothing leaves your browser, and no model or hosted database is called.

These vectors were assigned by hand to make the exclusion behaviour visible. They do not establish semantic quality. In a real system, compare retrieval against labelled queries and check missed relevant records as well as misleading high-ranked results.

Run the same retrieval pattern locally

Download the dependency-free Python implementation. Save it locally and run:

python visual-retrieval-demo.py --self-test
python visual-retrieval-demo.py --tenant north --query 1 0
python visual-retrieval-demo.py --tenant south --query 0 1

The implementation validates vectors, applies the tenant and validity scope, computes cosine similarity and returns ranked source references. Tenant is an explicit trusted input to this educational command-line program. A web API must derive it from authenticated server-side identity rather than accept a client-provided claim.

The self-test covers cross-tenant exclusion, expired evidence, ranking, zero vectors and incompatible dimensions. These tests establish the behaviour of the small example only. It has no user authentication, persisted index, model inference, approximate search or answer generation.

To connect a real embedding provider, introduce an adapter with a pinned model identifier, dimensions, timeouts and batch limits. Persist source and model versions alongside chunks. Treat partial ingestion as a recoverable job; do not expose an incomplete replacement index as if migration succeeded.

Retrieval and action need separate checks

Retrieved passages should be treated as evidence, including when they contain instructions. Do not permit a document to redefine the assistant’s tools or approvals. OWASP’s vector and embedding guidance discusses retrieval-related exposure and poisoning risks; controls need validation against the application’s actual trust boundaries.

The CAE interpretation places retrieval inside a wider context and execution design. A relevant maintenance note can inform a proposal. It cannot grant permission to alter an inspection date. The owning scheduling service still checks the caller, current state and required approval.

Measure quality before increasing scale

Create a labelled evaluation set spanning ordinary requests, ambiguous language, obsolete sources and forbidden material. Measure recall of relevant permitted evidence, citation correctness, exclusion failures and useful abstention. Report the dataset and conditions with every result.

Operational measures also matter: ingestion lag, failed updates, deletion completion, query latency and cost per accepted answer. Deleting a source requires removing or suppressing its derived chunks, caches and downstream copies according to the retention design.

A vector database is one retrieval component. Keyword search, structured queries and hybrid retrieval may be better for exact identifiers or specific tasks. Compare them with the same evaluation set. This article does not recommend a vendor or claim that vector search is always needed.

The book explains the broader enterprise context and authority design. The companion article, AI Agents, Agentic AI and Enterprise Context, shows where retrieved evidence enters an execution loop and why permission remains a separate decision.