The index can be behind.
A revoked document may still exist in search. Removing it asynchronously cannot be the only protection.
Recheck DynamoDB before using evidence.
Cloud engineering / Applied AI / Case study 01
Enterprise knowledge.
Earned trust.
A permission-aware RAG platform on AWS. Built end to end—from document ingestion and private infrastructure to evidence-grounded answers that respect who is asking.
BUILT WITHAmazon BedrockECS FargateOpenSearchDynamoDBTerraformFastAPIReact + TypeScript
58 / 58Infrastructure checksRepository-defined posture checks
22Live evaluation questionsSynthetic corpus · Bedrock inference
12 / 12Edge checksHealth, headers & rejection paths
8 / 8Ingestion lifecycle checksOCR, quarantine, versions & deletion
Recorded 1 October 2026. The AWS dev stack was torn down after verification, so there is no live endpoint. Inspect the evidence and its limits ↗
Watch / Two-minute tour
Same question.
Different person. No leak.
A walkthrough of the application and the platform behind it: permission-aware answers, citations, revocation, ingestion, the AWS architecture and the recorded evidence. App screens are rebuilt from the React UI with synthetic users and documents.
01 / The engineering problem
An answer is only useful
if it is allowed.
Enterprise documents carry access rules, revisions and sensitivity labels. A useful retrieval system has to preserve those constraints while documents, permissions and models change.
Yesterday’s access can expire.
Caches and conversation history can retain information a user is no longer allowed to see.
Reauthorize every reuse path.
A document is data.
Files can contain malware, incomplete extraction or instructions aimed at the model. A plausible answer is insufficient evidence.
Scan inputs. Validate claims. Abstain when needed.
02 / What I built
The application.
The platform behind it.
Six connected areas of engineering, with implementation links for a closer look. The scope covers user experience, data lifecycle, access control, model operations and AWS delivery.
01 / ENGINEERING
Identity & authorization
Access is evaluated on the server.RS256/JWKS tokens, tenant boundaries, group resolution, explicit denies, clearance and project entitlements. Rechecks protect cache, history and direct document access.
Explore implementation ↗02 / ENGINEERING
Retrieval & answer quality
Find evidence. Check it. Cite it.Filtered BM25 and vector search, reciprocal rank fusion, reranking, table-aware context, sufficiency checks and server-resolved citations.
Explore implementation ↗03 / ENGINEERING
Ingestion & lifecycle
Handle more than the happy path.PDF, DOCX, HTML and text; ClamAV and Textract; deterministic IDs, checkpoints, duplicate handling, staged versions, quarantine, replay and deletion.
Explore implementation ↗04 / ENGINEERING
Model governance
Every call follows a policy.A versioned Bedrock registry controls approved routes, classification ceilings, fallback, concurrency, deadlines, request budgets and estimated usage.
Explore implementation ↗05 / ENGINEERING
Cloud platform
Infrastructure you can inspect.Modular Terraform for private Fargate services, OpenSearch, nine DynamoDB tables, encrypted storage, event orchestration, edge controls and recovery configuration.
Explore implementation ↗06 / ENGINEERING
Full-stack delivery
A usable application and its tooling.React/TypeScript research UI, FastAPI endpoints, citation inspection, feedback, container builds, CI definitions, deploy scripts and operational runbooks.
Explore implementation ↗03 / Architecture atlas
Explore the system.
One boundary at a time.
Ten architecture views explain how the components fit together. Select a view, then open the full-resolution drawing to inspect the details.
The complete AWS platform
CloudFront and a private origin connect the application to Fargate, OpenSearch, DynamoDB and Bedrock. An independent event path ingests and publishes source documents.
Diagram figures are backed by files in docs/verification; recovery targets are proposed. Use the preserved reports for the metrics quoted here. Entra, SharePoint, Purview and optional LangSmith are not live-verified integrations.
04 / A question through the system
Models fill the slots.
Code sets the rules.
A deterministic state machine bounds model behavior. Every transition has a purpose, and evidence can lead to an answer, a limited result or an explicit abstention.
Identity & context
Verify the token. Build permissions on the server. Revalidate history and cached evidence before reuse.
Search & authorize
Run filtered BM25 and vector search. Fuse candidates, recheck the authoritative record, then rerank and pack.
Generate & cite
Use approved evidence as untrusted input. Validate structured claims and resolve citation metadata on the server.
Judge or abstain
High-assurance mode waits for judgment and allows one repair. Deterministic failures cannot be overruled by the model.
Bounded by design: 40 rerank candidates · 10 evidence passages · 6,000 context tokens · at most one retrieval retry and one repair.Inspect configuration ↗
05 / Results you can inspect
Evidence, with
its boundaries intact.
The retained in-VPC evaluation used live Bedrock against managed OpenSearch and DynamoDB. The corpus and principals were synthetic. Its results are a development snapshot.
| Live evaluation metric | Recorded result |
|---|---|
| Questions / scenario checks passed | 22 / 7 of 7 |
| Recall@10 | 1.0000 |
| nDCG@10 | 0.9754 |
| Citation validity | 100% |
| Observed authorization violations | 0 |
| Observed injection-string hits | 0 |
| Abstention accuracy | 1.0000 |
06 / Decisions under real constraints
The interesting work
was in the tradeoffs.
Deployment exposed issues that local tests could not. The repository records both the design choices and the fixes needed to make the AWS ingestion path work.
Authorization / Consistency
Separate search from authority.
OpenSearch holds a derived ACL copy. DynamoDB holds current permissions and versions. Revocation takes effect on subsequent policy checks without waiting for an index purge.
Organization policy / Model access
Adapt the architecture to the account.
Use Ohio, Nova and Titan under the recorded account constraints. Use Converse-based reranking and a ClamAV sidecar where the preferred managed alternatives were unavailable.
Data lifecycle / Publication
Prefer a temporary gap to mixed versions.
Stage new chunks, conditionally flip the current-version record, then publish and retire. The read-time version check protects against partial publication and old revisions.
Encryption / Event delivery
Verify the path, not just the resources.
Encrypted SQS needed an EventBridge KMS grant. Artifact writes needed an explicit SSE-KMS header. Both were deployment lessons captured in configuration and tests.
Availability / Cost
Make dev compromises visible.
One NAT gateway, one OpenSearch node and disabled interface endpoints reduce dev overhead. The documentation explicitly avoids presenting that footprint as highly available production infrastructure.
Recovery / Security
Restoring data can restore old permissions.
The recovery runbook calls out revocations lost after a restore point. Reapply those decisions before reopening traffic. Recovery is part of the authorization design.
07 / Delivery status
Built. Verified.
Still being proven.
Different parts of a platform mature at different speeds. This is the status supported by the retained reports and source review—not a claim of current uptime.
Recorded live in dev
The AWS core
Event-driven ingestion, ClamAV, Textract OCR, Titan embeddings, OpenSearch/DynamoDB, live retrieval and answers, private edge health and rejection paths.
See verification ↗Implemented / not live-verified
Enterprise integrations
Entra sign-in, Graph group overage, SharePoint permissions and Purview classification. Optional self-hosted LangSmith is defined separately and not deployed.
See integration matrix ↗Next acceptance work
Production readiness
Human-reviewed model quality, judge calibration, concurrency and resilience testing, image remediation, restore drills, independent security review and staging/prod deployment.
See readiness checklist ↗08 / Go deeper
Read it. Run it.
Challenge the decisions.
The repository includes the implementation, synthetic data, evaluation harness, diagrams and runbooks. Local development works with fixture models and no cloud credentials.
LOCAL QUICKSTART / DOCKER · PYTHON 3.12 · UV · NODE 22+
# Clone the project git clone https://github.com/abh2050/enterprise-rag-aws.git cd enterprise-rag-aws # Install and start the local stack make install make up # Open http://localhost:5173 # Run deterministic pipeline tests make test
Local answers are explicitly marked FIXTURE. They exercise the pipeline, not live-model quality. This portfolio is a separate static documentation page.
Complete README ↗Features, setup, APIs and operationsRepository guide ↗Where each capability livesEngineering walkthrough ↗A demo and interview narrativeThreat model ↗Boundaries, mitigations and testsRecovery runbook ↗Restore state and preserve revocationsDeployment runbook ↗Environment setup and rollout
How to demonstrate permission-aware retrieval locally
Sign in as Alice from Acme finance and ask about the New York travel per diem. Switch to Bob from engineering and repeat the question, then ask about tier-1 recovery objectives. Switch to Carol from Globex to demonstrate the tenant boundary. Open citations and explain why cached answers and history are reauthorized. Use the security tests to demonstrate revocation; no admin UI is implied.
Abhishek Shah / Cloud & applied AI portfolio
From a document to an answer.
Accountable at every boundary.
A case study in building the application and understanding the infrastructure, permissions, failure modes and evidence behind it.