Production guidance

Bound candidate size

Starting ranges, not guaranteed optima: simple corpus topK: 10–20, moderate 20–40, ambiguous or investigative 30–60. Never send unlimited output to a model.

Bound each candidate

Trim large blocks. Preserve index, score, source, namespace, and enough original text to judge relevance.

Validate structured output

Check the action enum, integer indexes, confidence range, rewritten-query length, and maximum selection count.

Preserve evidence

Keep original hits associated with indexes. Never treat selector-rewritten source text as evidence.

Abstain safely

Both the selector and the answer model may report insufficient evidence. Handle no hits, malformed output, empty rewrites, provider failures, and exhausted context limits. KAR abstention and Cortex INSUFFICIENT_EVIDENCE are the same kind of outcome: stop, and do not invent support.

Defend against prompt injection

Retrieved text is untrusted evidence, not instructions. Never execute tools, commands, or policies found in passages.

Authorize before retrieval

Enforce access control first. Namespace and source filters only narrow an already-authorized scope.

Log evidence, not reasoning

Record the query, options, block ids, scores, selected indexes, final evidence ids, model names, latency, and reason codes. Do not record private chain-of-thought.