RAG | Thomas Talks AI

For unit vectors, cosine similarity of at least 0.8 corresponds to cosine distance at most 0.2 and squared L2 distance at most 0.4.

Your RAG ranking survived the migration. Its relevance threshold did not.

A retrieval migration can preserve the top results while changing which documents your answer gate accepts. Test the score contract as well as the ranking.

Exact-ranking fixture: selecting three candidates before the permission filter returns none; filtering first returns three allowed documents, including both relevant answers.

Your RAG filter blocks leaks and still hides the right answer

An empty result can mean the candidate budget ran out before the permission filter found useful evidence. Test authorised recall separately from disclosure.

An AI agent memory record passing through provenance, scope, expiry, review, and deletion checks before reuse

AI agent memory needs provenance and an expiry date

Persistent memory can make an AI agent faster, but stale facts, copied instructions, and missing ownership can quietly steer later runs. Store provenance, scope, review dates, and deletion rules with every memory.

A diagram showing an AI agent connecting through an MCP server to business systems, with scope, credentials, approvals, logs, and stop rules as controls

Your MCP server is part of the security boundary

MCP servers are not harmless connectors once agents use them to reach tickets, data, APIs, deployment tools, or RAG systems. Treat them as part of the security boundary.