I built an open-source RAG engine with org-level access control, because I couldn't find one

Nj — Fri, 16 Oct 2026 15:31:40 +0000

Most open-source RAG tools I tried had the same gap. Either org-level access control sat behind a paid enterprise tier, or everything lived in one shared workspace per team. For a real company, where HR, finance, and engineering can't all see each other's documents, that isn't enough.

So I built Production RAG, a local-first RAG engine with org support built in, under Apache 2.0.

Permissions belong in the query, not after it

Many RAG setups retrieve the top-k chunks and then filter out what the user can't see. That leaks information through ranking, and it returns fewer results than asked for. Production RAG enforces an Org → Department → Team → User hierarchy directly in the SQL WHERE clause, so the user's scope is applied before anything is ranked.

One Postgres, two kinds of search

Dense vectors miss exact IDs, dates, and jargon. Keyword search misses paraphrases. Production RAG runs both inside Postgres, pgvector HNSW for semantic search and Postgres full-text search for keywords, then fuses them with Reciprocal Rank Fusion. A small ONNX cross-encoder reranks the top candidates on CPU. No separate vector database to run.

Local-first

It auto-detects a local Ollama and uses local ONNX embeddings, so it runs fully offline with no API keys. If you want a cloud model, OpenAI, Claude, or Gemini plug in with one environment variable.

The rest

Admin / editor / viewer roles and per-user API keys
Parent-child hierarchical chunking
SSE token streaming in the web UI
A rag eval CLI that reports Recall@K and MRR, plus a sample knowledge base

Try it

docker compose up -d

Repo: https://github.com/njNagaraj/RAG-production