This is where naïve RAG quietly breaks. Every one of these will happen in production — design for them now, not after the incident.

Stale & contradictory sources

Two documents disagree — an old policy and a new one. Filter by recency, prefer authoritative sources, and when a genuine conflict remains, have the model surface both with their dates rather than silently pick one.

Access control & multi-tenancy

PII

Detect and redact sensitive data at ingestion, and again on output. Know what you're storing and where — and be able to delete a person's data on request.

Out-of-scope, empty, and huge retrieval

• Out-of-scope questions. Users ask things your corpus can't answer. A confidence threshold on retrieval scores — plus the honest "I don't know" from Module 7 — keeps the system from bluffing. (You watched this in the Module 1 playground.)
• Empty retrieval. No good matches → say so; don't force an answer from weak context.
• Huge retrieval. Hundreds of matches → re-rank hard and cap k; never dump everything into the window.

Duplicates, tables, and adversaries

• Near-duplicate chunks. The same boilerplate appears in fifty documents and floods your top-k. De-duplicate at ingestion and diversify results (e.g. MMR) so the context isn't five copies of one sentence.
• Tables & numbers. Prose-tuned embeddings are weak on tabular data. Keep tables intact, handle them deliberately, and never trust a number the model "remembered" — cite the row.
• Adversarial documents. Content designed to manipulate the model (the injection from Module 7). Sanitise inputs, sandbox permissions, and validate outputs.