RAG quarantine
The RAG quarantine screen lets a data steward review the documents that the poisoning screening isolated in a
knowledge base, release or reject them, and follow the upstream and downstream lineage of a dataset. Portal path:
/data/quarantine. Data stewards, security officers and tenant administrators use it.
What the screen shows
The page title is RAG quarantine and lineage. Two tabs:
- Quarantine: the Knowledge base section with an id field and the Apply button (hint "Data steward duty:
tenant admin or security officer."). Once a knowledge base id is applied, the Quarantined documents table shows
Id, Title, Status, Classification, Created (at most 200 documents, oldest first). A click on a row
opens a drawer with the document record, including its
quarantinescreening result. Without any document, the table says "No quarantined document". - Dataset lineage: a Dataset id field with Apply; the answer (
dataset,produced_by,consumed_by,upstream,downstream) is shown as JSON, two levels deep.
Actions
| Button or action | What it does | API call | Roles |
|---|---|---|---|
| Apply (Quarantine) | Lists the quarantined documents of the base | GET /v1/knowledge-bases/{kb_id}/quarantine | tenant_admin, security_officer, data_steward |
| Release (row menu) | Opens a dialog with Reason, then makes the chunks searchable again (status active) | POST /v1/knowledge-bases/{kb_id}/documents/{doc_id}/review | tenant_admin, security_officer, data_steward |
| Reject (row menu) | Opens a dialog with Reason, then sets the status rejected; the chunks stay out of retrieval | POST /v1/knowledge-bases/{kb_id}/documents/{doc_id}/review | tenant_admin, security_officer, data_steward |
| Apply (Dataset lineage) | Reads the dataset and its graph | GET /v1/lineage/datasets/{dataset_id} | any tenant user |
Roles
Release and Reject are hidden for users who lack one of the roles of ROLES.dataStewards in
portal/src/lib/kit.ts: tenant_admin, security_officer, data_steward. The Control Plane applies the same list
(REVIEW_ROLES in services/control-plane/src/eai/domains/knowledge/__init__.py) to the list and to the review, and
also requires the viewer relation on the knowledge base. Each decision goes through the policy decision
knowledge.document.review, is stored with its reason and is audited as knowledge.document.release or
knowledge.document.reject.
Typical tasks
Review a flagged document
-
Open the queue. Documents with a suspicious content wait here instead of being searched. Open Quarantine, paste the knowledge base id, then click Apply.
Expected result: the Quarantined documents table.
If it fails:
forbiddenmeans your role is not a data steward role. -
Read the screening. Click the row.
Expected result: the drawer shows the
quarantineblock with the reason of the isolation.If it fails: if the block is empty, read the document in the source system before deciding.
-
Decide. Open the row menu, choose Release or Reject, write a Reason, then confirm with the button of the dialog.
Expected result: the toast "Done" and the document leaves the queue.
If it fails:
document_not_quarantinedmeans another steward already decided.
Follow a dataset
-
Read its lineage. Open Dataset lineage, type the dataset id (with or without the
dataset:prefix), then Apply.Expected result: the JSON with the producers and the consumers.
If it fails:
not_foundmeans no dataset has this id.
Troubleshooting
| Symptom | Cause | Fix |
|---|---|---|
forbidden (403) with required_roles | You are not tenant_admin, security_officer or data_steward | Ask for the data_steward role |
| Release and Reject missing from the menu | Your roles are not in ROLES.dataStewards | Same fix |
not_found (404) with knowledge_base | Wrong knowledge base id | Copy the id from Knowledge bases |
document_not_quarantined (409) | The document is no longer quarantined | Refresh the table |
not_found (404) with dataset | Unknown dataset id | Find the node in Lineage |
vector_store_unavailable (503) | The vector store does not answer during the decision | Retry once the vector store is back |