Module 5 · 115 min

RAG & AI Agents

From Answers to Actions: Retrieval, Tools, Memory and Autonomy. Why retrieval exists and what it does not fix, the anatomy of a grounded system, provenance and citation discipline, two-layer evaluation, tool calling, agent components, memory and state, the autonomy ladder, agent security and an applied design lab.

Lesson progress

0 / 12 steps

Not started

Learning objectives

Draw and explain a retrieval-augmented generation pipeline end to end, from source corpus and ingestion through chunking, indexing, retrieval, context assembly, generation and citation display to logging.
Distinguish parametric model knowledge, context supplied in a single conversation, a governed retrieval corpus, and a tool call to a system of record — and say which one a given requirement needs.
Diagnose whether a poor answer originated in retrieval or in generation, and name the specific retrieval fault where it did.
Specify provenance requirements: source ownership, versioning, currency, access control carried through retrieval, and the ability to inspect the passage that supports a claim.
Define two-layer evaluation — retrieval quality first, answer groundedness second — and explain why a single aggregate accuracy figure is insufficient.
Separate reading a source from asking a system or performing a computation, and specify argument validation, permissions and error handling for a tool call.
Place a proposed system on the spectrum from chatbot to RAG assistant, tool-using copilot, bounded workflow agent and more autonomous multi-step agent.
Define working state, workflow state, user memory and system-of-record data separately, with minimisation, expiry, correction and provenance rules for each.
Choose the minimum necessary autonomy level for a task and place human approval gates by consequence and reversibility rather than by disclaimer.
Review an agent design for security and containment: indirect prompt injection, excessive permissions, exfiltration, loops, duplicate actions, and the monitoring, audit and rollback paths that bound them.

Continuing from Module 4

Module 4 stopped deliberately at a boundary: knowing where an answer came from. This module crosses it. Retrieval turns 'the model said so' into 'this approved document says so, and here is the passage'. Tools turn an answer into an action. Autonomy decides how much of that action happens before a human sees it — and that, rather than model capability, is where the governance work of the next few years sits.

Why retrieval-augmented generation exists

Module 4 ended at a boundary. A language model answers from two things: what was absorbed into its parameters during training, and what is in front of it in the current context. Neither is a governed knowledge source. Parameters are undated, unattributed and unchangeable by you. Context is whatever this particular user happened to paste, this particular time.

Many important healthcare knowledge questions fail on one or both counts. Which antibiotic does this hospital's local policy recommend for this indication, in the version approved last month? What does our escalation SOP say about out-of-hours cover? Which of our clinics currently accepts this referral type? These are questions about a specific organisation at a specific time. Even where something similar was present in training data, the model has no reliable way to know whether its parametric knowledge reflects the current authoritative local source — so an answer produced without consulting that source is plausible text rather than information.

Retrieval-augmented generation is the standard architectural response, introduced in the research literature by Lewis and colleagues in 2020: before the model answers, a retrieval step finds relevant passages from a defined corpus and places them in the context. The model then answers from material it can be pointed at, and the interface can show the learner or clinician which passages were used.

The value proposition is worth stating precisely, because it is narrower than the marketing. Currency: the corpus can be updated today without retraining anything. Locality: the corpus is your policies, your pathways, your formulary — not an average of the internet. Provenance: an answer can be tied to a passage a human can open and read. Updateability: withdrawing a superseded document removes it from every future answer at once. Each of these is a data-governance property of the corpus, in the sense Module 2 gave that word — a retrieval corpus is a dataset, and it inherits every question about ownership, versioning, coverage and representativeness that Module 2 asked of any other dataset.

It is worth being concrete about what that buys an organisation, because the prize is real. Institutional knowledge in most healthcare organisations is fragmented across intranets, PDFs, shared drives and the memory of whoever has been there longest, and the cost of that fragmentation is paid in bleep calls, in out-of-hours guesswork and in variation between people who happen to know different things. A governed retrieval layer makes one maintained answer reachable at the moment of the question, in the same form for everyone. Add tools and the same architecture can act inside a workflow — booking, checking eligibility, drafting the referral — under permissions and an audit trail. That combination is why agentic systems are being pursued: not novelty, but the possibility of doing governed work rather than only producing governed text.

And the limitation, which is the single most important sentence in this module: retrieval reduces some failure modes but does not make answers true. The model can retrieve the right passage and still summarise it wrongly, over-generalise it, merge it with parametric knowledge, or attach a citation to a claim the passage does not support. Masanneck and colleagues (2025) evaluated base and retrieval-augmented models on 130 questions drawn from 13 neurology guidelines: retrieval improved performance, and potentially harmful answers still occurred. Grounding is a control that raises the floor. It is not verification.

Worked example: a governed referral hand-off

Retrieve the current approved referral protocol for this pathway — the version in force today, not the one someone saved to a desktop last year.
Extract the guidance that applies to this patient's situation, with the source passage shown alongside it.
Pre-populate the referral work item with the fields the protocol requires.
Validate that every required field is present and internally consistent, and flag what is missing.
The clinician reviews, corrects and approves; nothing leaves the system unapproved.

The value here is not a cleverer answer. It is less fragmented coordination: fewer bleep calls to find the current protocol, fewer incomplete referrals bounced back, less rework — while supervision and provenance stay intact, because a named human approves the output and every claim can be traced to the passage it came from.

Ask the model directly

The answer comes from parameters shaped during training.

Strength: Fast; fine for general explanation, drafting help and language work.
Limitation: Undated, unsourced, unaware of your organisation, and impossible to correct except by changing the model.

Paste the document into the chat

The answer comes from context the user supplied this once.

Strength: Genuinely grounded for that conversation, and often the right tool for a one-off task.
Limitation: Depends on the user finding the correct, current document; nothing is governed, versioned, permissioned, logged or repeatable. It is not a system — and long context windows do not change that.

Governed retrieval (RAG)

A maintained corpus is searched per question and the retrieved passages are placed in context.

Strength: Currency, locality, provenance, access control and updateability — because the corpus is owned, versioned and monitored.
Limitation: Adds a retrieval system that can itself fail, and requires someone to own the corpus. Retrieval quality caps answer quality.

Call a system (tool use)

The system queries a live source of record or performs a computation.

Strength: The only correct approach for live state — capacity, eligibility, appointment slots, a patient's current medication list.
Limitation: Requires permissions, argument validation, error handling and an audit trail. A wrong tool call can change the world, not just the answer.

Sources & evidence · 11 sources

This module cites public or consensus guidance, scholarly literature.

Content reviewed: September 2026. Publication dates of the individual sources are shown in each citation.

Lewis P, Perez E, Piktus A, et al. Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. Advances in Neural Information Processing Systems 33 (NeurIPS 2020).
The foundational RAG architecture: combining a retriever over a document index with a generative model. A machine-learning architecture paper, not evidence about healthcare deployment or safety.
Open source
Yao S, Zhao J, Yu D, et al. ReAct: Synergizing Reasoning and Acting in Language Models. International Conference on Learning Representations (ICLR) 2023.
An early and influential pattern interleaving reasoning steps with tool actions, underlying much current agent design. It is a capability demonstration on general benchmarks, not evidence that autonomous action is safe in healthcare.
Open source
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. 2024.
A structured risk-management companion to the NIST AI RMF, covering risks including confabulation, information security, information integrity and data privacy, with suggested actions across the lifecycle. A voluntary framework, not a regulation, and it does not certify any system.
Open source
Masanneck L, Meuth SG, Pawlitzki M. Evaluating base and retrieval augmented LLMs with document or online support for evidence based neurology. npj Digital Medicine. 2025;8:137.
Evaluated base and retrieval-augmented models on 130 questions drawn from 13 neurology guidelines. Retrieval support improved performance, and potentially harmful answers still occurred. Use it for the principle that RAG is not verification; the setting is one specialty and a defined question set, so do not generalise the effect size.
Open source
Kresevic S, Giuffrè M, Ajcevic M, et al. Optimization of hepatological clinical guidelines interpretation by large language models: a retrieval augmented generation-based framework. npj Digital Medicine. 2024;7:102.
A controlled demonstration that grounding a model on specific clinical guidelines, with prompt and text-processing optimisation, improved guideline-interpretation accuracy in hepatology. A single-domain study against guideline reference answers, not a clinical outcome trial, so the effect size should not be universalised.
Open source
Debenedetti E, Zhang J, Balunović M, et al. AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. Advances in Neural Information Processing Systems 37, Datasets and Benchmarks Track (NeurIPS 2024). arXiv:2406.13352.
A benchmark environment showing that tool-using agents can be manipulated through untrusted external content, and that proposed defences are partial. Non-healthcare, so treat it as architecture and security evidence rather than clinical evidence — the design implication is that controls must sit outside the model.
Open source
Greshake K, Abdelnabi S, Mishra S, Endres C, Holz T, Fritz M. Not What You've Signed Up For: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security (AISec '23), ACM CCS 2023. arXiv:2302.12173.
The foundational description of indirect prompt injection: instructions placed in content the model retrieves or reads are followed as if issued by the user. Not healthcare-specific, and a demonstration of attack feasibility rather than a measure of real-world incidence.
Open source
Es S, James J, Espinosa-Anke L, Schockaert S. RAGAS: Automated Evaluation of Retrieval Augmented Generation. Proceedings of the 18th Conference of the European Chapter of the Association for Computational Linguistics (EACL 2024): System Demonstrations, pp. 150-158. arXiv:2309.15217.
One openly published framework for evaluating retrieval context, faithfulness and answer relevance without extensive reference answers. One framework among several, not a universal standard, and its automated judgements should themselves be validated against human review on your own question set.
Open source
Liu NF, Lin K, Hewitt J, et al. Lost in the Middle: How Language Models Use Long Contexts. Transactions of the Association for Computational Linguistics. 2024;12:157-173. doi:10.1162/tacl_a_00638.
Evidence that model performance can depend on where relevant information sits within a long context, supporting the argument that retrieving and ordering less, better material beats retrieving more. The findings are task- and model-specific rather than a universal law.
Open source
National Institute of Standards and Technology. Secure Software Development Practices for Generative AI and Dual-Use Foundation Models: An SSDF Community Profile. NIST SP 800-218A. July 2024.
Software and security development guidance for generative AI systems, framed as a community profile of the Secure Software Development Framework. General software security guidance, not an agent-specific or healthcare-specific standard, and NIST does not certify systems against it.
Open source
OWASP GenAI Security Project. OWASP Top 10 for Agentic Applications for 2026. Published 9 December 2025.
Community and industry guidance cataloguing common risks in agentic applications, useful as a checklist when reviewing a design. Not peer-reviewed evidence and not a certification scheme.
Open source

Capstone Board Pack

Add what you just learned to your own strategy document while it is fresh.

Open capstone