Enterprise Search Portals: Hybrid RAG at Scale for Compliance-Sensitive Knowledge Work

Abstract—Enterprise search portals are starting to use large anguage models to produce direct answers, but regulated advisorworkflows need stricter controls than normal chat systems. Thesystem must be fast, must not leak restricted content, andmust produce outputs that can be audited. This paper presentsa policy-first Hybrid Retrieval-Augmented Generation (RAG)architecture for enterprise portals at scale. The design combineslexical retrieval (BM25) and dense vector retrieval, enforcesaccess control before any text reaches reranking or generation,fuses rankings using Reciprocal Rank Fusion, and generatesanswers only from an evidence pack with required citations.We describe the end-to-end architecture, threat model, andsecurity controls for prompt injection and retriever poisoning,along with an evaluation scorecard that reports retrieval quality,answer grounding, hallucination rate, audit coverage, and latency.Experiments on compliance-focused enterprise QA benchmarksshow that the proposed approach improves Recall@K and answeraccuracy while reducing hallucinations and achieving full audittrace coverage.

Index Terms—enterprise search, retrieval-augmented genera-tion, hybrid retrieval, compliance, audit logging, vector databases