Agentic retrieval-augmented generation systems can find evidence that simple searches miss, but they also create decision chains that must be supported by transparent records at every step, according to a new technical report published by The New Stack. While basic RAG systems execute a single query and return results, agentic RAG allows an AI agent to rewrite questions, select multiple data sources, combine different search methods, and retry failed queries. The report argues that this added power requires a matching commitment to evidence trails, or even good answers can't be trusted.
A retrieval operation that looks like one step to a user actually involves a series of choices by the agent, the report explains. The agent interprets what the user wants and builds a query, picks data sources, applies filters, examines what it finds, and then decides if the evidence is strong enough to support specific claims with citations. Each of these choices can go wrong in ways that don't show up in the final answer. An agent might search a support index when the question concerns billing, strip out a product name while rewriting the query, or pull the correct policy from the wrong customer's account. The final response could sound persuasive but be incomplete, outside the intended boundaries, or unsafe to share. A one-shot retriever makes a single pass, but an agentic system may make several, and any of those attempts can fail without leaving a visible mark.
The report states that retrieval systems must treat source metadata as a core part of the search process, not an afterthought. Semantic similarity measures how closely language matches, not whether a source has authority or is current. A policy from last year can match a question perfectly and still be the wrong result if a newer policy with different wording is the only one the agent should use. According to the report, "A similarity score is an opinion; a scope filter is a rule the system can enforce." Fields like effective date, owner, access scope, document type, approval status, jurisdiction, and tenant identity should all influence filtering and ranking. A regulatory question may need an approved primary source, a product question may favor the most recent published manual, and a customer question must remain within that customer's boundaries. The report warns that an unauthorized or expired record should be excluded even when its wording appears to be a closer match, and metadata rules can run before similarity ranking, after it, or at both stages depending on data and risk.
The report recommends that applications define enforceable retrieval policies rather than relying on vague instructions like "be accurate." Customer data should stay within verified customer scope, regulatory answers should use approved sources for the correct jurisdiction and effective date, and a missing primary source should result in a qualified answer or a request for review. These constraints should live in tool permissions, query filters, and application code, not in prompts the model is asked to remember. The report states, "The agent decides what to ask; the retrieval layer decides what may be returned." Retrieved content must be treated as untrusted input, even when the application controls the source, because documents can contain embedded instructions that corrupt answers or steer subsequent searches. Evaluations should test decisions separately from final answers, scoring corpus selection accuracy, recall, tenant isolation, citation coverage, and claim support. The report concludes that confidence grows when the system can account for every decision, and the evidence path should be a visible output rather than a detail buried in logs. For teams looking to deploy these patterns, stakes are rising as agents gain authority to act on what they retrieve, making the gap between a confident answer and a defensible one a liability no prompt engineering alone can close.