What does behavior-preserving modernization mean?

It means documenting the current system’s observable inputs, outputs, calculations, permissions, workflow states, and exceptions so intentional changes can be separated from accidental behavioral drift.

Do you rewrite legacy systems from scratch?

Not by default. The preferred path is to map risk, introduce testable seams, and modernize in bounded stages when that reduces operational risk.

What kinds of .NET systems are a fit?

Common fits include ASP.NET, ASP.NET Core, MVC, Web Forms, Classic ASP, VB.NET, C#, SQL Server, stored-procedure-heavy systems, reporting workflows, internal admin tools, and API modernization.

What if our business logic is mostly in SQL Server?

SQL-side business rules are treated as part of the application behavior. The modernization work maps stored procedures, jobs, reports, transactions, owners, and representative parity scenarios before replacement.

Can you help with AI without exposing private data?

Yes, when the engagement is designed around approved data boundaries, secure channels, least-authority access, and an appropriate local, private, hybrid, or managed model approach. Public forms must not receive secrets or regulated data.

What is human-reviewed AI?

AI output remains proposed work until a named reviewer can inspect evidence, edit, approve, reject, block, or escalate it under explicit workflow rules.

What is governed RAG?

Governed RAG adds source ownership, access control, provenance, content states, citation rules, refusal behavior, evaluation, and human escalation around retrieval.

What happens after the first fit call?

If the problem fits, the next step is usually a scoped assessment or package proposal. Sensitive system details move to an approved private channel rather than the public form.

Do you publish client metrics?

Only when the source material and exact wording are approved. Public-safe case pages distinguish methods, sample artifacts, measurement models, and approved outcomes so templates are not presented as client results.

How do you handle confidential systems?

Public routes collect only high-level context. Private code, credentials, PHI, customer records, and confidential architecture require a separately approved secure handling path.

LongtermSoftware.com

Retrieval starts with source governance

A governed RAG system begins by deciding which sources are authoritative, who owns them, how access is enforced, and what lifecycle states exist. Embedding every available document without that model creates faster access to the same conflicts, stale instructions, and unknown ownership that already undermine the knowledge base.

Source inventory and content ownership should be completed before ingestion volume becomes the success metric.

Use provenance and trust states as part of retrieval

Useful metadata includes source owner, effective date, review date, sensitivity, audience, version, approval state, and replacement relationship. Content states may include approved, draft, stale, quarantined, superseded, and retired.

These fields should influence indexing, filtering, answer construction, citation, and escalation. They are operational controls, not decorative metadata.

Design answer boundaries and refusals

The system should state when an answer is supported, when evidence conflicts, and when a question falls outside the approved corpus. A source-grounded refusal is often safer and more useful than a fluent answer based on general model knowledge.

Answer policies should define minimum evidence, citation requirements, allowed synthesis, restricted topics, and escalation to a human owner.

Evaluate retrieval and answer support separately

Retrieval quality asks whether the right evidence was found. Answer quality asks whether the generated response accurately represents that evidence. A system can fail either stage, so tests should record retrieved sources, ranking, support, missing evidence, and reviewer judgment.

Representative questions should include known answers, ambiguous requests, stale-content conflicts, access-controlled content, and unsupported questions.

Operate the knowledge system over time

Governed RAG requires content review, stale-source handling, access changes, evaluation after corpus or model changes, and an owner for unresolved questions. The system is not finished when the first index is built.

The operating model should state who can add sources, approve content, change retrieval rules, review failures, and decide when an answer path must be blocked.

Buyer checklist

Inventory sources and owners.
Define content states and metadata.
Apply access rules before retrieval.
Make citations and refusals visible.
Evaluate both retrieval and answer support.
Assign ongoing content and evaluation ownership.

Frequently asked questions

Does RAG remove hallucination?

No. It can provide relevant evidence, but generation can still misrepresent, omit, or overstate that evidence.

What is vector sprawl?

It is broad, weakly governed ingestion that creates many embeddings without clear source ownership, access rules, lifecycle states, or evaluation.

Should every answer include citations?

Citation requirements should match the workflow. High-impact factual answers should expose supporting sources and refuse when support is inadequate.

Governed RAG Is Not Just Vector Search