What we investigate
Preserve the source and ingestion history before rebuilding a retrieval index. A suspicious answer may reflect a poisoned document, stale permissions, retrieval behaviour or another cause.
Response work to agree
- Record document IDs, source versions, ingestion jobs, access controls and index configuration.
- Determine which applications and users consumed the affected source or memory.
- Quarantine the suspect ingestion route or source under approved change control.
- Rebuild from trusted material where appropriate and verify source permissions, provenance and representative retrieval results.
What safe recovery requires
Deleting a single document may not remove cached context, replicas or persistent memory. Define the affected stores and validation evidence explicitly.
Start with a non-sensitive brief
Use the incident brief builder or contact the team. Describe the affected service, observed impact and whether activity is ongoing. Availability, authority and delivery scope are confirmed before response begins.
Turn observations into investigation questions
| Observation | Evidence to seek | Decision to resolve |
|---|---|---|
| Answers changed after a knowledge-base update | Original source, ingestion job and deployed index version | Which change preceded the behaviour? |
| An untrusted source displaced approved content | Source provenance, retrieval results and ranking configuration | Which users or workflows received the source? |
| The issue remained after deleting a document | Caches, replicas, conversation context and memory stores | Which copies or derived records are still in use? |
Preserve the version before rebuilding
A rebuild can remove useful evidence of the ingestion path. Authorised owners should preserve the relevant source and configuration first where compatible with containment needs. Recovery should verify provenance, permissions and representative queries against trusted material, including any memory or cache layer implicated by the event.
What we agree to deliver
The scope identifies the questions to answer, records available, customer owners and permitted changes. Typical outputs include an event timeline, the affected boundary, approved containment actions, recovery checks and unresolved risks. The deliverables page explains how findings connect to evidence.
Continue with rag containment and provenance, or compare response engagement options.
