Retrieval that cites. Agents that leave a trail. A gate that fails the build.

A groundedness gate scores every answer in an evaluation set against the passages the system actually retrieved, then fails the continuous integration run when the score crosses a threshold. It is a test, not a dashboard: the pipeline goes red and the release stops. CourtNetra, the platform MetaMinds built and runs, executes an automated hallucination evaluation weekly in CI and fails the build above 2%. On a client system the threshold is yours, because the tolerable rate for an internal summary and for a cited legal authority are not the same number.

Four deliverables, and they are the same four whether the engagement lands at the $18,000 floor or in the typical $28,000 to $70,000 band: a corpus audit of what is actually in the documents, a chunking and embedding choice with the reasoning recorded, hybrid retrieval with the filter pushed into the query, and reranking with citations and a refusal path. Every build also leaves an evaluation set and a baseline that stay with you, because without them nobody can tell later whether the system got worse.

Because dense vectors match meaning and professionals search for exact strings. A policy number, a statutory section, a party name or a claim reference is the precise token somebody typed, and a paraphrase-matching index can miss it entirely. Hybrid retrieval runs a lexical index and a dense index together and reconciles the two result lists by reciprocal rank fusion, so an exact-string hit and a semantic hit both reach the reranker. CourtNetra runs exactly this: dense pgvector similarity and tsvector BM25, merged by reciprocal rank fusion.

Pushing the filter down means date, jurisdiction and access rights become predicates inside the retrieval query rather than a step that runs after it. An approximate nearest neighbor index returns its candidate list before a later predicate is applied, so filtering afterwards discards most of that list and the reranker chooses from whatever survived. Filter first and every candidate returned is already in scope. It is also how permissions stop being a prompt instruction and become a query constraint, which is the only version an auditor accepts.

MetaMinds runs production retrieval over 18,863,754 Indian judgments on CourtNetra: 39,158 Supreme Court and 18,824,596 High Court decisions across all 25 High Courts, 1950 to the present. The vector index holds 687,289 chunks under HNSW, in the subset selected for vector retrieval, on self-hosted PostgreSQL with pgvector. Corpus size is rarely the binding constraint. Access rules, conflicting versions of the same policy and scans with no text layer usually are, and week one of a build finds them.

It is the branch where the system declines instead of answering. When retrieval returns nothing above the relevance floor, or the retrieved passages do not support the claim being made, the correct output is a refusal that names what was searched, not a fluent paragraph. Declining is the cheapest control in a retrieval system and the one most often left unbuilt, which is why a confidently wrong answer usually reaches a customer before it reaches a test.

Yes, and the $5,500 RAG system diagnostic exists for that. It runs one to two weeks, a $1,000 deposit reserves a named start week, and it delivers a report and a walkthrough naming the pipeline stage that causes the failure, the evidence behind that finding, and the parts your own team can fix without us. A rebuild is frequently the wrong first purchase, and where the diagnostic finds the system is sound, that is the finding.

Four records kept per step rather than per session: the input, the retrieved context, the decision, and any human override. With those, what the agent did on 14 March and why is a query rather than an investigation. Around them sit the parts that are harder than the planning: idempotency keys so a retry never sends the same email twice, an authority matrix stating what the agent does alone, what it proposes and who approves, and cost-aware routing so a small model classifies and a larger one only reasons.

It starts at $22,000 and typically lands between $35,000 and $90,000. The floor buys the step-level audit trail, replay-safe idempotent steps, the authority matrix and cost-aware model routing. What moves a project up the range is how many systems the agent has to write to and how much of the approval path already exists. Nothing here is a quote: a fixed number named before anyone has seen the corpus and the integrations is a guess, so the floors are published and the quote follows scoping.

Yes, from $24,000, typically $40,000 to $80,000, and that is its usual purchase: a system already in production that nobody can put a number on. It ships a golden dataset built from your own corpus rather than a public benchmark, a groundedness rubric and scoring harness, a CI gate at a threshold you set, and prompt injection and indirect prompt injection cases. The harness is handed over, because a gate only the vendor can run stops being run once the vendor leaves.

Because a percentage in a contract is unenforceable until both sides agree how it is measured: on which questions, against which corpus, and on which pinned model version. The baseline is that agreement written down as a test that keeps running. Build it before the commitment and the number is defensible. Agree the number first and the measurement gets designed backwards to fit it, which turns an accuracy clause into a dispute rather than a control.

Usually not. If the pipeline hands the model the wrong passages, a fine-tune teaches it to write a more fluent wrong answer over the same wrong evidence. Fine-tuning earns its place for output format, tone and narrow classification, and those are the cheaper problems. Retrieval quality is fixed in the retrieval layer, in this order: chunking, filtering, hybrid search, reranking. Only then is the model worth touching.

Because a lexical score and a vector similarity are not on the same scale, and neither is stable from one query to the next, so adding them makes the answer depend on whichever index happened to produce larger numbers. Reciprocal rank fusion ignores the scores and uses position instead: a document both indexes rank highly rises, a document only one of them found can still surface, and nothing has to be normalized or retuned per query. CourtNetra merges dense pgvector similarity with tsvector BM25 this way, which is why an exact statutory citation and a paraphrase of the same point both reach the reranker.

Chunk to the unit a person would cite, not to a fixed number of characters. A defined term and the clause that depends on it belong in the same retrieved passage, so the boundaries follow the document's own structure: the clause, the section, the schedule, the numbered paragraph. Where the definition lives elsewhere in the document, it travels with the chunk rather than being left for the model to guess at. This is the cheapest stage to get right and the most expensive to find late, because a fixed window that splits a clause from its definition produces answers that are fluent, cited and wrong.

Indirect injection is instruction text hidden inside the documents the system retrieves rather than typed by a user: a line in an uploaded file or a fetched page telling the model to ignore its instructions, repeat its prompt, or approve something. Those cases go into the evaluation set beside the accuracy ones and are built from your own corpus, so a run reports both what the system got wrong and what it obeyed that it should have refused. The guardrail and evaluation platform ships those cases, and the harness that runs them is handed over with them.

The index is built to be rebuilt. New and amended documents are chunked and embedded on the same rules as the originals, and the embedding choice is recorded with its reasoning so re-embedding is a job rather than a project. The evaluation set then runs again, which is the point: a change in the corpus shows up as a change in the score rather than as a complaint from a user months later. Withdrawn documents have to leave the index and the response cache as well as the source system, because a system that cites a superseded policy version confidently is worse than one that finds nothing and says so.

An ISO/IEC 42001 certificate is issued by an accredited certification body and a SOC 2 report by a licensed CPA firm, each after its own audit that you commission directly. What MetaMinds does is gap assessment, readiness, control design and evidence preparation, so the artefacts an auditor asks for exist before the audit starts: the control design, the evidence index, and the evaluation record showing the system behaves as described.