RAG in Morocco: build a reliable document assistant

A RAG project in Morocco connects a language model to company documents so that answers can be grounded in sources retrieved at question time. The pattern sounds simple: search, give context to the model, then generate. In production, reliability depends on document quality, access rights, retrieval, citations and continuous evaluation.

What RAG actually adds

Retrieval-Augmented Generation does not replace document management or governance. It adds a search chain for a generative model. A question becomes a query, relevant passages are retrieved, and the model receives those passages as context. Google Cloud’s official RAG reference architecture separates ingestion, response serving, databases and quality evaluation.

This separation matters. A strong model cannot compensate for an incomplete index, an obsolete document or an incorrect permission. Reliable RAG in Morocco is therefore designed as a complete information system, not a chatbot pointed at a folder.

Begin with a bounded use case

The first scope should have a precise name: retrieve an internal procedure, explain a contract clause, prepare a support response or assist research in a controlled repository. An AI audit helps compare these use cases by value, feasibility, risk and adoption.

Scoping defines authorised users, accepted sources, languages, sensitivity and the questions the system must refuse. It also states when human validation remains mandatory. That boundary protects users from placing undue confidence in a fluent answer.

Inventory sources before selecting technology

Documents may come from shared workspaces, portals, knowledge bases, business applications or object storage. For each source, identify its owner, update frequency, format, access policy and authoritative version. Two conflicting copies of one procedure become two competing truths in the index.

A useful inventory separates valid documents, archives, drafts and material that must never be indexed. It also defines the deletion path: removing a source from the document system should trigger controlled removal from indexes and caches.

Prepare documents without losing structure

Ingestion converts PDF, office files, web pages or records into searchable content. Scanned material first needs OCR and quality control. Tables, headings, lists, notes and page numbers should remain attached to the text they explain. The guide to intelligent document processing covers that upstream workflow.

Extraction must preserve provenance: document identifier, version, owner, validity date, language, location and confidentiality. Without metadata, filtering, citing and deleting information become unreliable.

Chunk content by meaning

Chunking determines the units offered to the search engine. Fragments that are too short lose context; oversized fragments mix topics and occupy the model’s context window. The right size follows the document structure and expected questions rather than a universal number.

Sections, clauses, question-and-answer pairs and table boundaries are useful natural limits. Each chunk retains its heading, hierarchy and link to the source. Several strategies may coexist across a corpus and should be compared with real questions.

Bind metadata to permissions

Semantic search must never bypass access control. Rights can belong to a document, group, department, project, client or confidentiality level. They are enforced during retrieval, before any text reaches the model. Microsoft’s official RAG and search guidance highlights granular access control and document-level security filtering.

Metadata filters also restrict searches by language, period, version or entity. The official OpenAI retrieval guide describes attribute filtering. In a vendor-neutral architecture, the principle is unchanged: the index knows the authorised scope before ranking results.

Combine lexical and semantic retrieval

Vector search connects wording by meaning. Lexical search remains useful for exact references, product codes, clause numbers, acronyms and names. Hybrid search combines both signals, and a ranking stage can reorder the most relevant passages.

Retrieval needs a minimum relevance threshold. When evidence is weak, the application should say so and avoid manufacturing an answer. Adding more chunks does not automatically improve quality; irrelevant context can distract the model from the correct source.

Write a response contract

The system message defines how sources are used, how citations appear and when the model must abstain. It can require separation between retrieved facts, interpretation and missing information. In a sensitive domain, the answer may remain a concise summary followed by supporting excerpts and links.

This contract is tested, versioned and observed like code. It does not replace access controls or server-side validation. A user prompt must never override the policy preventing disclosure of unauthorised content.

Show verifiable citations

A useful citation points to an identifiable document, its version and, when possible, a section or page. It lets the user check the context and detect an unsupported interpretation. A list of filenames at the end does not prove that every statement is grounded.

The application retains the relationship between retrieved chunks and generated claims. If two sources disagree, it can expose the conflict or ask for clarification rather than silently choosing one.

Support French, Arabic and English

A Moroccan corpus may mix French, Modern Standard Arabic, English, transliteration and internal terminology. Evaluation therefore covers questions in each language and cross-language retrieval. Acronyms, spelling variants, product names and Darija terms should be observed in real queries.

The system may detect language, expand a query with variants or use multilingual embeddings. It still preserves the source language in citations and avoids translating a regulatory term without signalling the transformation.

Keep the index fresh

Freshness is part of quality. Ingestion detects creations, changes and deletions, then updates only what changed. Every chunk carries a version and validity state. An interrupted indexing run should not replace a coherent index with a partial one.

Plan migrations for embedding models, metadata schemas and chunking strategies. Changes are tested on a separate index, compared, then released with a rollback procedure.

Evaluate retrieval first

A bad answer may originate in search or generation. Evaluation first checks whether the expected passages appear in the results and at what rank. A test set connects representative questions to expected sources, including unanswered and ambiguous questions.

Then evaluate the answer for faithfulness, relevance, citation quality and abstention. Google Cloud’s reference architecture includes a separate quality subsystem for measures such as factual accuracy and relevance. Results are tracked by corpus, model and prompt version.

Build a business test set

The best questions come from real tickets, searches, procedures and conversations after anonymisation. Include common cases, exceptions, similar documents, old versions and unauthorised requests. Domain experts validate expected answers and reference sources.

The set grows after incidents and user feedback. It becomes a product asset: before changing an index, model or prompt, tests verify that quality has not regressed.

Resist injection and poisoned content

An indexed document can contain a malicious instruction aimed at the model. Retrieved text must be treated as untrusted data, never as authority that can change system policy. Risks described by the OWASP Top 10 for LLM applications also require controls over outputs, called tools and material admitted to the corpus.

Ingestion verifies source, file type and editorial status. Sensitive actions still require explicit authorisation and deterministic validation. A document assistant does not implicitly gain permission to execute a business operation.

Protect data and logs

Chunks, embeddings, questions and answers may contain sensitive information. Data governance defines purpose, retention, encryption, access, audit and deletion. Diagnostic logs minimise personal data and mask secrets.

The choice between a managed service, private cloud and internal hosting depends on corpus constraints. The guide to a private LLM in Morocco helps frame that choice, while each source’s confidentiality remains the starting point.

Observe the entire chain

Reliable operations track ingestion time, failed documents, index freshness, queries with no result, cited sources, refusals and response time. Every answer is traceable to the versions of corpus, retrieval configuration, model and prompt.

This traceability follows MLOps principles: version, test, release progressively and roll back. User feedback is qualified before it becomes evaluation data; a simple positive rating cannot diagnose retrieval quality.

Deploy a controlled pilot

A pilot begins with a controlled corpus and a known user group. It measures the ability to retrieve the right source, answer faithfully, cite and refuse. Errors are classified across ingestion, permission, search, generation and interface.

Once these mechanisms are stable, the scope can expand to more sources or integrate with business AI agents. Action automation only comes after information reliability and authorisation controls.

Avoid common mistakes

• indexing every file without an owner or editorial status;
• applying permissions after generating the answer;
• evaluating only the style of generated text;
• hiding sources or citing a document without a precise passage;
• answering despite weak or contradictory retrieval;
• deploying without deletion and reindexing procedures.

Turn documents into verifiable knowledge

Reliable RAG in Morocco connects four disciplines: controlled documentation, relevant retrieval, constrained generation and continuous evaluation. Value comes not from the volume indexed, but from answers users can verify and are authorised to access. To scope a corpus, architecture and multilingual pilot, explore Kanteek’s Artificial Intelligence service or talk to our team.