Making isolation structural, not conversational

The system answers market-research and product-claims questions over a large enterprise document estate — roughly 1.5 million indexed chunks drawn from several SharePoint sources plus an approved external web source. Every answer carries mandatory citations and an explicit sufficiency verdict.

The interesting constraint wasn’t scale. It was that evidence from the open web must never appear in an answer about internal regulated content, and “must never” has to mean something stronger than an instruction in a prompt.

The retrieval path

Ingestion runs per source and auto-generates the classic Search quartet — data source, skillset, indexer, index:

• Extraction handles tables, OCR, and complex layout rather than flattening documents to plain text. Most of the content is slide decks and reports where the meaning is in a chart.
• Vectorisation with a large embedding model.
• Image verbalisation — a vision model describes embedded images and the description is embedded alongside the surrounding text. This is what makes a number that only exists inside a chart retrievable at all. Without it, a substantial fraction of the corpus is invisible to search while appearing perfectly well indexed.
• Chunk enrichment projects last_modified as sortable and filterable, and the document path as searchable, so recency and noise filtering key on real fields rather than on the model inferring freshness from text.
• Error tolerance is deliberate: per-document failures are recorded but don’t halt a run. A content-filter-blocked image or an oversized PDF should not stop an ingestion of hundreds of thousands of documents.

Query time uses agentic retrieval — the system plans the query, runs hybrid vector and keyword search, and applies semantic reranking, then a synthesis model composes the answer under instructions that enforce citations, a Yes / No / Partially / Insufficient verdict, and a human-review footer.

The isolation problem

The naive approach is one index, everything in it, and a prompt that says don’t use web sources when answering internal questions.

That fails for the obvious reason: prompts are advisory. Anything reachable is eventually reached — through an unusual phrasing, a multi-hop question, or a user who simply asks the system to ignore its instructions. It also fails silently. Nothing alerts you that web evidence leaked into a regulated answer; you find out when someone notices a citation pointing somewhere it shouldn’t.

The fix: topology as the control

Rather than one corpus with rules about it, the estate is split into separate knowledge bases, each carrying only its own sources. A space’s knowledge base contains the sources that space is permitted to see, and nothing else.

The approved-web source is attached to one shared web-only knowledge base and nowhere else. A space that is allowed web evidence reaches it through a separate retrieve call, routed by an explicit registry.

The property this buys: a source not attached to a knowledge base cannot be retrieved from it. Not “should not”. Cannot. There is no phrasing, no injection, and no multi-hop question that reaches content which isn’t in the index being queried. The guarantee is structural, so it holds regardless of what the model is asked or what it decides to do.

The topology is authored as a single declarative file, validated in CI, and compiled two ways — into the knowledge bases themselves and into the per-environment registry the API routes on. One source of truth, two derived artefacts, no drift between what the config says and what the infrastructure does.

What it cost

More knowledge bases to provision and keep in sync, and a routing layer the API has to resolve on every request. Sources are shared by reference rather than re-ingested, so the storage cost is near zero, but the operational surface is genuinely larger.

Worth it. The alternative was a guarantee that depended on a model’s cooperation, which is not a guarantee.

The general point

When a security or compliance property matters, look for a place to enforce it that isn’t the prompt. Prompts express intent; architecture expresses constraint. In retrieval systems, the index boundary is usually available as a control surface, and it’s a much stronger one than any instruction — it holds even when the model is wrong, adversarially prompted, or replaced entirely.

Azure AI Foundry, Azure AI Search agentic retrieval, Azure Functions, APIM behind Front Door, Azure SQL via managed identity, Bicep IaC, Azure DevOps.