Design an enterprise RAG assistant over 10M documents with per-user permissions.

A production RAG path parses and chunks trusted content, builds sparse and dense indexes, retrieves broadly, reranks narrowly, assembles cited context, and evaluates both retrieval and grounded generation. Freshness, ACL filtering, latency, and failure observability are first-class.

Make interfaces and ownership explicit; add versioning, access control, monitoring, canary rollout, rollback, and a plan for delayed labels or human review.