A regulatory RAG assistant on Azure, with a CI gate on answer quality
Three pipelines sit behind one streaming API: hybrid RAG (BM25 plus dense, fused with RRF), GraphRAG and agentic RAG. All three are scored on the same 60 questions, so the choice of default is a measurement and not a preference.1
- Every pull request is evaluated. CI runs lint, 139 tests, Terraform validation and a live evaluation. If answer quality drops below the threshold the merge is blocked. Deploys need approval and roll back automatically.
- Security was tested, not assumed. Token auth, document-level security trimming and PII masking. Injection through retrieved passages succeeded 1.4% of the time on a plain prompt and 0 of 240 times against the agent.
- Costs are known. OpenTelemetry traces every request. The agent costs about $3.54 per 1,000 requests and takes 12.4 s at the median, against about $2 and 3.9 s for the baseline.
What didn't work
- The knowledge graph didn't help. The agent never called its graph tool and GraphRAG only matched the baseline.
- The router didn't pay for its extra cost, so the agent is the default.
- The judge is the same model as the generator, so absolute scores are optimistic. Trends matter more.
Built with Python, FastAPI, Azure AI Search, Azure OpenAI, Container Apps, Terraform, GitHub Actions with OIDC, OpenTelemetry, pytest
Answer correctness by pipeline
60 questions, scale 0 to 1
Retrieval after tuning
Chunking, hybrid fusion and reranking, over 40+ runs