Katkat
Back

Design an Auditable Internal AI Chatbot

J.P. MorganSoftware Engineer · Technical Screen
EasySoftware EngineerTechnical ScreenSystem Design

Last updated

Design an enterprise RAG-based AI assistant that enforces role-based document access control, bounds conversation history, mitigates prompt injection, and maintains an immutable, compliance-grade audit trail.

Scenario

Financial institutions rely heavily on internal knowledge bases (research reports, compliance manuals, internal procedures), but employees operate under strict Chinese walls and entitlement boundaries. Design an auditable internal AI chatbot that answers employee queries based on internal documents while guaranteeing data isolation, injection defense, and full compliance auditing.

Requirements

Functional Requirements

  • Permission-Aware Retrieval: The system must only retrieve and synthesize answers from documents the querying user is entitled to view.
  • Bounded Context: Limit context retention per session (e.g., maximum N turns or time-based expiry) to minimize token consumption and reduce cross-topic context contamination.
  • Adversarial Hardening: Defend against direct prompt injection (malicious user queries) and indirect prompt injection (malicious instructions embedded inside retrieved documents).
  • Compliance Audit Logging: Log every user query, model response, prompt template version, retrieved document chunk IDs, and confidence scores into an immutable, tamper-evident audit store.

Non-Functional Requirements

  • Low Latency: End-to-end response time (P95) under 2.5 seconds (including retrieval and generation streaming).
  • Audit Immutability: Audit logs must satisfy strict regulatory compliance (WORM - Write Once, Read Many semantics).
  • Security & Privacy: Zero cross-tenant or cross-department data leakage.

Scale Assumptions

  • User Base: 50,000 employees; peak concurrent users: 2,500.
  • Throughput: ~50 queries per second (QPS) at peak.
  • Corpus: 5 million internal documents (~20 million vector chunks), updated continuously.

What Your Answer Should Cover

  1. High-Level Architecture: Diagram the interaction between API gateway, authentication/authorization service, RAG pipeline, LLM orchestration, and the audit subsystem.
  2. Retrieval & Access Control: Compare pre-filtering vs. post-filtering of document ACLs in the vector database.
  3. Audit Trail Data Model: Define the schema for compliance logging and how immutability is maintained.
  4. Security & Guardrails: Detail input sanitization, system prompt isolation, and output verification mechanisms.

Hints

Hint 1

Consider enforcing document access lists (ACLs) directly inside the vector search index via metadata filtering rather than filtering after retrieval.

Hint 2

For immutable compliance records, combine an append-only event stream (like Kafka) with Write-Once-Read-Many (WORM) cloud object storage or cryptographic hash chains.

Hint 3

Address indirect prompt injection by running a secondary validator or strict delimiters to isolate retrieved context from instructions in the LLM prompt.

Follow-up questions

  • How does the system handle real-time revocation of a user's document permissions without re-indexing vector embeddings?
  • If an ingested document contains an indirect prompt injection attempting to exfiltrate other documents, how can your pipeline prevent it?
  • How would you implement PII/MNPI (Material Non-Public Information) redaction both before retrieval indexing and before logging to the audit store?