Global Advisors re-architected document-grounded AI so the user-facing collaboration application could retain a stable experience while retrieval, embedding, ranking and model services operated as independently scalable platform capabilities.

The central design was a thin adapter behind the application's existing contract. It translated document events, user context and questions into external collection, ingestion and retrieval operations. This preserved the option to use the application's built-in path while creating a governed route to a more capable shared retrieval estate.

Maturity: active internal deployment with continuing hardening of richer permission semantics, backend portability and service-class management.

A broad fork of the user application would have created long-term maintenance cost. Replacing the client would have harmed adoption. Leaving retrieval embedded would have constrained scale and reuse. The problem was therefore to change the architecture substantially while changing the application contract as little as possible.

The responsibility model was explicit:

• the collaboration application remained the source-document and user-experience authority;
• the adapter remained the contract owner and translation layer;
• the retrieval platform owned collections, ingestion, search and contextual retrieval;
• the model gateway owned approved model access; and
• dedicated embedding and ranking workers handled high-volume specialist computation.

This made heavy AI infrastructure replaceable without rewriting the user surface and made the user application upgradeable without rebuilding the retrieval estate.

The implementation included more than request translation:

• a backend interface with built-in and external operating modes;
• per-user or permission-scoped collection creation and lookup;
• document create, update, deletion and metadata translation;
• collection membership changes when access changed;
• scoped search and contextual-answer requests;
• central handling of retryable backend saturation;
• caller-side limits on concurrent ingestion work;
• persistent content-hash caching and configurable skip windows;
• exclusion rules for unsuitable file types or content;
• startup validation, diagnostic logging and end-to-end request tracing;
• deployment guidance for embedding and model dependencies; and
• an upstream-alignment discipline that kept backend-specific code out of the stable controller path.

The most important design issue was not relevance; it was entitlement. The client contract carried user identity, but not every rich group, tag or record-level policy that a downstream index might ideally receive.

We therefore refused to treat indexing as permission. Collections became an explicit translation of the authority available from the source application. Retrieval filters were applied within that scope. Where a richer policy concept was absent from the contract, it was recorded as extension work rather than inferred from weak signals.

This distinction matters because a retrieved fragment is a new disclosure event. Source access, ingestion permission and answer-time access must align, even when documents or memberships change after initial indexing.

Configuration and process state diverged

Changing a profile file did not change a live process that had already loaded it. Safe capacity transitions required draining or restarting an instance, or moving traffic to a pre-warmed alternative.

Thin forks require discipline

It was tempting to add application-specific behaviour in the stable controller. Keeping backend logic behind the adapter reduced merge cost and preserved the value of upstream improvements. Compatibility was an architectural objective, not housekeeping.