Skip to content
AccountMade
Sign inBook a demo
Resources/Template

Technical evaluation

RAG architecture diagram for buyer evaluation

A RAG diagram helps a buyer see data, trust and operating boundaries. It separates the ingestion path from the query path and shows what happens when retrieval or authorization fails.

AccountMade Research · Updated · 2 sources
Download diagram (SVG)
Reference diagram. Download the editable source above to adapt it.

Filled diagram assumptions

Illustrative example. Names, volumes, dates and outcomes are fictional; replace them with approved evidence before use.

ComponentExample responsibilityExplicit limit
Ingestion serviceTags approved documentsDoes not grant user access
Retrieval serviceFilters by workspace contextDoes not decide retention
Model invocationReceives selected passagesDoes not establish data-processing terms
Audit storeRecords event metadataRetention requires policy

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Draw the two paths

The ingestion path includes content source, extraction, chunking or transformation, index or vector store, metadata and retention decision.

The query path includes user identity, authorization, query transformation, retrieval, model invocation, response, and audit or feedback event. Show which component owns each transition.

OpenAI’s vector-store documentation describes attaching files to a vector store and searching relevant chunks. It is one implementation reference, not a complete architecture or a substitute for an authorization and retention design.

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Illustrative reference architecture

Illustrative example. Names, volumes, dates and outcomes are fictional; replace them with approved evidence before use.

An authorized support analyst enters a query. The application checks workspace role, calls retrieval with the user and workspace context, retrieves only tagged documents, and sends selected passages to the model. Responses include source links and feedback.

A separate ingestion service accepts approved documents, records file metadata, and removes content under the agreed retention rule. The diagram marks the model provider, file store and audit store as separate boundaries.

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Buyer review questions

  • Which documents may enter the index, and who approves them?
  • How does retrieval enforce tenant and user authorization?
  • Where are source links, prompts, and feedback retained?
  • What does the system return when evidence is missing or access is denied?
  • Which component is responsible for deletion or correction?

Sources: NIST AI Risk Management Framework

Sources and dates

  1. OpenAI vector stores API reference ↗

    Official reference for file-backed vector stores and search.

    Reviewed 2026-09-08
  2. NIST AI Risk Management Framework ↗

    Primary framework reference for governance and risk discussions.

    Reviewed 2026-09-08

Found an error or a changed source? Send a correction.

Related resources

GuideAnswering an AI security questionnaire with product evidence →TemplateAI agent architecture diagram with operating responsibilities →TemplateSoftware product datasheet template →TemplateTechnical solution brief: template and completed example →

Apply this to your company

Draft your next buyer document from approved claims.

Briefs and decks from approved facts, every claim sourced.

See the demo →