ControlBrief

A research assistant that answers from approved sources and shows its citations.

Illustrative walkthrough reconstructed for this case study: a test question about Workspace Agents, an example answer, and the source registry. This is not a recording of live retrieval.

Only twelve of the 24 approved sources in this local research MVP could be indexed. The result was an answer that could show convincing citations while missing relevant sources. The registry below records the gap; the walkthrough is illustrative, not a live retrieval result.

Why I built it

I kept running into early compliance questions around AI products, vendor claims, and rollout decisions. I wanted a way to organize the relevant public sources before asking legal, compliance, security, or data protection specialists for a full review.

What I built

I built a local MVP for my own testing. It searches approved sources and returns an answer with citations, risks, confidence, and questions for a specialist. It is a research aid, not legal advice.

The registry has 24 approved sources. Twelve are indexed into 528 chunks that the app can search.

What failed

The other sources blocked access or returned empty pages, so the app could not use them to answer questions.

That left gaps in the answers even when the citations looked convincing.

ControlBrief source registry showing blocked public law sources and indexed retrieval chunks. — The source registry records fetch status and the number of indexed chunks.

What I’d change

I would show missing sources beside each answer and make the human-review flags easier to scan. I would also add stable snapshots for official sources that block retrieval.

How I built it

I built the local interface in Python and Streamlit, split approved content into chunks, and stored the embeddings in Chroma. OpenAI APIs generate the answer from the retrieved chunks and attach citations.

Why can a cited RAG answer still be incomplete?

A citation identifies retrieved material. It does not establish coverage of sources the app could not index. In this MVP, blocked or empty pages left half the approved registry outside retrieval. That is an observed limit of this setup, not a claim about every RAG system.

Is this a production compliance system?

No. I built and tested it locally as a research aid. Specialist review remains part of the intended process. Missing-source warnings and stable source snapshots are proposed changes, not implemented features.

My professional overview connects this prototype to the other AI work on the site.