rootzero | Educational RAG retrieval controls | 4 November 2026

Python 3.10+; standard library only. No network, LLM API, real customer data,
embeddings or production authentication. The principal and approved metadata
are supplied by a fictional fixture. A real service must derive these values
from trusted server-side identity and document systems.

Keep rag_demo.py and fixture.json in the same directory, then run:
  python rag_demo.py

The output includes expected and actual document IDs for ten synthetic cases,
an explicit denominator, a fixed evaluation date and the fixture SHA-256.
results.json is the recorded output. It is not a model or product benchmark.
These checks do not measure answer correctness, semantic retrieval quality,
prompt-injection robustness or the security of a real deployed service.

Permitted and denied cases cover tenant, role, revision, expiry, quarantine,
missing metadata and an unknown answer. Ranking is simple lexical overlap,
not BM25, vector search or a hybrid engine. Returned text is never executed.

Series: https://rootzero.eu/dossiers-ia-cyber/
English: https://rootzero.eu/en/ai-security-guides/

Original demonstration code by rootzero, released under the MIT License.
Copyright (c) 2026 Thucy SARL.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in
all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
THE SOFTWARE.