AccountMade
Sign inTalk to usGet started
Resources/Template

Technical evaluation

RAG architecture diagram for buyer evaluation

A RAG diagram helps a buyer identify data, trust, and operating boundaries. It should separate the ingestion path from the query path and show what happens when retrieval or authorization fails.

Accountmade Research · Updated · 2 sources
Download diagram (SVG)
Illustrative reference diagram. Download the editable source above to adapt it.

Filled diagram assumptions

Illustrative worked example. Names, volumes, dates, and outcomes are fictional; replace them with approved evidence before use.

ComponentExample responsibilityExplicit limit
Ingestion serviceTags approved documentsDoes not grant user access
Retrieval serviceFilters by workspace contextDoes not decide retention
Model invocationReceives selected passagesDoes not establish data-processing terms
Audit storeRecords event metadataRetention requires policy

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Draw the two paths

The ingestion path includes content source, extraction, chunking or transformation, index or vector store, metadata, and retention decision. The query path includes user identity, authorization, query transformation, retrieval, model invocation, response, and audit or feedback event. Show which component owns each transition.

OpenAI’s vector-store documentation describes attaching files to a vector store and searching relevant chunks. It is one implementation reference, not a complete architecture or a substitute for an authorization and retention design.

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Illustrative reference architecture

Illustrative worked example. Names, volumes, dates, and outcomes are fictional; replace them with approved evidence before use.

An authorized support analyst enters a query in the application. The application checks workspace role, calls a retrieval service with the user and workspace context, retrieves only tagged documents, and sends selected passages to the model. The response includes source links and a feedback event. A separate ingestion service accepts approved documents, records file metadata, and removes content according to the agreed retention rule. The diagram marks the model provider, file store, and audit store as separate boundaries.

Sources: OpenAI vector stores API reference · NIST AI Risk Management Framework

Buyer review questions

  • Which documents may enter the index, and who approves them?
  • How does retrieval enforce tenant and user authorization?
  • Where are source links, prompts, and feedback retained?
  • What does the system return when evidence is missing or access is denied?
  • Which component is responsible for deletion or correction?

Sources: NIST AI Risk Management Framework

Sources and dates

  1. OpenAI vector stores API reference ↗

    Official reference for file-backed vector stores and search.

    Reviewed 2026-09-08
  2. NIST AI Risk Management Framework ↗

    Primary framework reference for governance and risk discussions.

    Reviewed 2026-09-08

Found an error or a changed source? Send a correction.

Related resources

GuideAnswering an AI security questionnaire with product evidence →TemplateAI agent architecture diagram with operating responsibilities →TemplateSoftware product datasheet template →TemplateTechnical solution brief: template and completed example →

Apply this to your company

Prepare materials for your next buyer conversation.

Accountmade helps technical B2B teams prepare demo decks, technical blueprints, business cases and security materials.

Explore Accountmade →