From RAG to Enterprise-Grade RAG Part 09 | Make documents actually enter, stay governed, and stay queryable: from ingestion to document APIs
Part 08 bundled four capabilities into five query modes, but no matter how strict the query-side routing gets, a broken document side still breaks the system — user A pulling user B's contract, header spoofing to impersonate other users, deleting a file and losing the chunks. This post walks through the seven stations a document actually travels after upload (parsing → raw storage → Postgres metadata → ingestion queue → auth/permission → document APIs → citation viewer), with the focus on the often-overlooked claim that the Vector DB cannot be the source of truth, four ACL failure scenarios (header spoofing / no tenant filter / app-layer filter with no RLS / JWT without membership check), and the citation viewer's payload as the last mile of explainability. Document-side seven stations (Part 09) + query-side five modes (Part 08) = the full production RAG closure.