# Retrieval-augmented generation

A pattern that retrieves external information at inference time and supplies selected results to a generative model.

technical-term · Context & knowledge · foundational · Reviewed 2026-08-09

## Definition

Retrieval-augmented generation combines a retrieval system with a model so responses can be conditioned on external, updateable sources. Retrieval can improve grounding and attribution, but it does not guarantee that selected content is relevant, current, complete, authorized, or true.

The architecture is established; production quality depends heavily on corpus governance, retrieval evaluation, and trust boundaries.

## Why it matters

RAG changes the evidence available to the model without changing model weights.

The retrieval pipeline is part of the assurance surface: ingestion, indexing, access control, ranking, provenance, and citation all require evaluation.

## System anatomy

- **Corpus:** The governed source material available for retrieval.
- **Retriever:** The method that selects candidates for a query.
- **Context assembly:** Ranking, filtering, and formatting the material shown to the model.
- **Attribution:** Links between claims and the exact retrieved sources.



## Important distinctions

- **Memory:** RAG is a retrieval pattern; it is not automatically an agent’s validated personal or project memory.
- **Ground truth:** Retrieved content can be incorrect, stale, conflicting, or poisoned.



## Implementation signals

- Enforce source-level access before retrieval
- Evaluate retrieval separately from generation
- Carry provenance and trust labels into context

## Failure modes

- Prompt injection stored inside the corpus
- A plausible answer cites irrelevant chunks
- Sensitive content is filtered after rather than before retrieval



## Related knowledge

- [Context engineering](https://aisdlc.ai/agentic-engineering/context-engineering) — The deliberate selection and maintenance of instructions, knowledge, tools, state, examples, and artifacts within a finite model attention budget.
- [Context window](https://aisdlc.ai/agentic-engineering/context-window) — The finite sequence of tokens a model can directly condition on during a single inference operation.
- [Durable project memory](https://aisdlc.ai/agentic-engineering/durable-memory) — Persistent, attributable project knowledge that carries decisions, outcomes, requirements, failures, and operating state across agent sessions without assuming that every stored item remains true or safe.
- [Instruction–data trust boundary](https://aisdlc.ai/agentic-engineering/instruction-data-trust-boundary) — An architecture that distinguishes authoritative instructions from retrieved content, memory, tool results, and external data through provenance, trust labels, privilege separation, validation, and mediated action.

## Sources and further study

- [arXiv / NeurIPS — Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks](https://arxiv.org/abs/2005.11401) — Introduces retrieval-augmented generation as a combination of learned generation and explicit retrieved non-parametric memory. **Use:** Primary definition. **Limitation:** The paper establishes an influential architecture, not a guarantee that retrieved content is current, correct, authorized, or safe to use.
- [Anthropic — Effective context engineering for AI agents](https://www.anthropic.com/engineering/effective-context-engineering-for-ai-agents) — A working model for treating model-visible context as a finite resource that must be selected and maintained. **Use:** First-party case study. **Limitation:** This first-party account documents one organization, product, or implementation context and should not be generalized without local evidence.
- [OWASP GenAI Security Project — Memory Is a Feature. It Is Also an Attack Surface](https://genai.owasp.org/2026/05/13/memory-is-a-feature-it-is-also-an-attack-surface/) — A focused account of why persistent agent memory requires integrity, provenance, and poisoning defenses. **Use:** First-party case study. **Limitation:** This first-party account documents one organization, product, or implementation context and should not be generalized without local evidence.

---

This library synthesizes cited research, standards, official documentation, and clearly attributed practitioner perspectives. Maturity describes the state of a concept—not vendor endorsement, production readiness, or permission to deploy. Benchmarks and demonstrations do not replace use-case evaluation, governed controls, independent verification, or named human release authority.