AWSAWS Certified Generative AI Developer - Professional2026-101.5 Design retrieval mechanisms for FM augmentation
Pack authorized evidence with traceable citations
Completed by the knowledge check
Learning objective
Assemble permission-filtered retrieved context with citations and a bounded context-window budget.
Core idea
The context sent to a foundation model is a released evidence package. Every included passage must be authorized, useful for the question, traceable to its source, and small enough to fit the complete model request. A retrieval count alone satisfies none of those requirements.
For an architect assembling that package, the order matters. Enforce permission before material reaches a model, preserve provenance while selecting passages, and count the final request before inference. If a document is unauthorized, remove it rather than hoping the generator ignores it. If evidence does not fit, reduce it deliberately rather than relying on silent truncation.
How it works
Keep permission attached to the evidence
Retrieve accepts a metadata filter within the supported retrieval configuration and returns retrievalResults containing content, metadata, location, and score. Build the filter from trusted caller context, using the mechanisms in 1.4.6. For a custom knowledge base, it sits under vectorSearchConfiguration; fully managed knowledge bases use managedSearchConfiguration instead.
A managed knowledge base whose data sources have ACL awareness enabled offers a native path: pass userContext.userId in Retrieve, and the service returns only documents that user may access. RetrieveAndGenerate cannot be used with a managed knowledge base, so generation over ACL-filtered results is a separate step. The userId is the user’s email address in the underlying data source. Without userContext, ACL-enabled data sources return zero results while non-ACL data sources in the same knowledge base still return results to every user, and a document with no ACL metadata is treated as inaccessible. Filtering can return fewer results than requested without backfill. AWS states that ACL awareness is filtering, not authorization: your application authenticates the user and supplies verified identity.
Permission-filtered retrieval is the first boundary. Before context assembly, verify the returned document’s policy and revision when your authorization design requires an authoritative check. A metadata predicate does not independently prove that the index still reflects a changed access-control record. The managed path has the same limit: AWS documents ACL changes as eventually consistent and caches identity-provider credentials for up to 1 hour. See 1.4.4 and 1.4.6 for authority and synchronization responsibilities.
Carry source identity through deduplication, reranking, and compression. If the application selects a passage from one result but retains another result’s location, it can generate a plausible answer with a misleading citation. Define an internal evidence record containing document identity, content revision, selected text, original location, and permission-check outcome. This record is an application design, not a required Bedrock object.
Only authorized evidence proceeds to a transformation or model stage. Permission checking after generation is too late because the generator has already consumed the passage. Likewise, a cache key must account for the authorization context under which the evidence was released; sharing a cached evidence package across callers can bypass an otherwise correct retrieval filter.
Allocate the complete token budget
Select the generation model and its documented context limit before packing evidence; see 1.2.1. The input includes system instructions, the current question, conversation history, tool definitions or results when used, evidence text, and formatting or citation instructions. Reserve output capacity rather than filling the entire limit with retrieved passages.
Use this application decision rule:
input budget = model context capacity - reserved output - safety margin
include evidence only while the complete input stays within that budgetThe safety margin is your operating policy, not a universal AWS quota. Converse.inferenceConfig.maxTokens bounds generation output, as 1.3.6 describes; it does not reduce oversized input or establish a retrieval budget. Keep conversation-history management in 1.3.9 and account for its result when assembling the complete request.
Count the final assembled request with the selected model’s supported token counter, as 1.3.9 describes for CountTokens and its model-specific routes. The count must cover the complete request, not the sum of approximate chunk sizes, because instructions, history, and formatting consume the same budget.
When the package exceeds the budget, deduplicate repeated passages, remove irrelevant material, and select evidence that covers distinct question clauses. Trimming a passage can delete a qualification or exception that changes its meaning. Prefer keeping a complete supporting passage over an isolated favorable sentence. If you summarize evidence, retain the source mapping and verify that the summary preserves the claim’s conditions.
Preserve citations through generation
For RetrieveAndGenerate, AWS returns citations connecting generated response segments to retrieved sources. generatedResponsePart.textResponsePart includes the text and its span, while retrievedReferences holds supporting source content, metadata, and location. Render the association between the answer segment and those references rather than showing an unconnected list of every retrieved document.
Custom Knowledge Bases prompt templates must retain $output_format_instructions$ for citations to appear, as documented by AWS. $search_results$ inserts the retrieved results into the generation template. Removing the citation-format placeholder while expecting the same citation output changes the contract; see 1.5.6 for the managed generation boundary.
For a custom Retrieve-plus-generation pipeline, the application owns citation assembly. Label authorized passages with stable internal source references, request references in the answer, and resolve them only against the released evidence package. Those labels are application identifiers, not AWS citation fields. Reject or qualify claims whose references do not resolve or whose cited passage does not support the claim.
A syntactically valid citation is not a truth guarantee. A passage can mention the right product without supporting a generated coverage statement. Check claim-level support, important exceptions, and permission to expose the citation destination. Do not reveal an inaccessible source’s title or URL merely because its text was filtered out.
Key distinctions and trade-offs
Candidate count versus token budget: numberOfResults limits retrieved chunks for a custom knowledge base. Chunk sizes and final request overhead vary, so it cannot establish that the request fits the model context window.
Permission versus relevance: A relevant passage can be unauthorized. An authorized passage can be irrelevant. Both tests must pass before selection, and authorization remains mandatory even when budget pressure encourages shortcuts.
Citation provenance versus claim support: Provenance tells you where text came from. Support asks whether that text justifies the answer. Preserving locations prevents attribution errors but does not replace evidence review.
Managed generation offers AWS citation structures and prompt controls. Custom generation gives you an explicit evidence-release and counting boundary, with responsibility for source labels and citation validation. Choose the boundary from the workload’s inspection requirements rather than treating citation output as proof that all context controls are implemented.
Architecture / decision scenario
An employee assistant compares two benefit policies. Its application calls Retrieve with the trusted employee-policy filter, then checks returned document revisions against the authoritative permission record. It removes a revoked document before any reranking or summarization model consumes it. On a managed knowledge base with ACL awareness, the application would instead pass the authenticated employee’s userContext and keep the revision check, because ACL changes propagate eventually.
The context builder deduplicates repeated paragraphs and retains one complete exception clause for each policy. It assigns internal source labels while preserving locations. After adding the question, conversation history, instructions, and output reserve, it uses the generation model’s supported token counter. If the input exceeds the budget, it removes redundant introductions rather than truncating the decisive exception.
For a RetrieveAndGenerate variant on a custom knowledge base, the team preserves $output_format_instructions$ and renders the returned answer spans with their retrieved references. For its custom variant, it resolves generated labels against the released package and verifies claim support. If one policy lacks authorized evidence, both variants disclose the incomplete comparison instead of citing an unrelated or inaccessible policy.
Common exam traps
- Checking permission only after generation or model-based summarization.
- Assuming a small chunk count guarantees a fitting prompt.
- Using
maxTokensas an input-context limit. - Counting with a different model or an unsupported endpoint.
- Removing
$output_format_instructions$and expecting managed citations. - Treating a citation or high relevance score as proof of claim support.
What to remember
Release only authorized, relevant evidence. Preserve source identity through every transformation, budget the complete model request with output headroom, and use a supported model-specific counter. Render managed citation associations or validate custom source labels against the exact released package. When evidence is missing or cannot fit safely, return a bounded, explicit outcome.
Knowledge check
A retrieved document’s permission was revoked after indexing. The context builder plans to summarize every retrieved passage with a model and then run the permission check on the summaries. Where must the check run instead?
A managed knowledge base has ACL awareness enabled on its data sources. The application authenticates employees and must return only the documents each employee may access. Which request does that?
RetrieveAndGenerate with userContext.userId from the authenticated sessionRetrieve with userContext.userId from the authenticated sessionRetrieve without userContext , relying on the data sources’ ACLsRetrieve with userContext.userId from a field the client submitsuserContext on Retrieve ; RetrieveAndGenerate cannot be used with a managed knowledge base. Without userContext , ACL-enabled sources return nothing while non-ACL sources still answer everyone, and AWS treats ACL awareness as filtering, so the identity must come from the application’s own authentication.A context builder keeps numberOfResults at 5, yet some requests still exceed the generation model’s context window. Which check establishes that a request fits?
numberOfResults until typical requests fit the windowmaxTokens to free room for the oversized inputmaxTokens bounds output, and a chunk count says nothing about chunk length.After deduplication and reranking, the builder keeps the selected texts in a new order but leaves their location values in the original order. Answers now cite the wrong documents. Which design prevents this?
A generated answer cites a passage that mentions the right product, but the passage does not state the exception the answer claims. The citation resolves to released evidence. What should the pipeline do?