Run permission tests with two roles, ask questions whose answers changed in source systems recently, verify citations map to live documents, and confirm high-risk answers require approval before action.

Stale indexes, missing access filters, duplicate conflicting documents, over-long context, and questions outside indexed sources. Production RAG reduces but does not eliminate hallucinations—monitoring and human escalation remain necessary.

Use a labeled question set from finance or operations with known correct answers and sources, track citation correctness and refusal rate monthly, and review failures after each major document or policy update.

Only when citations resolve to current approved documents and high-impact actions require approvers. Train staff to treat unsourced or conflicting answers as triggers for human review—not as final compliance guidance.

Production RAG syncs live connectors with permissions across time zones and regional document stores; demo RAG uses static files. Trust testing on demo data misleads buyers—run tests on production connectors in a controlled pilot environment.