Building an enterprise AI platform: permission-aware RAG that holds up in production
A reference architecture for enterprise AI: hybrid retrieval, user-scoped tools, fail-closed access control, event-driven deletes, and eval-gated CI/CD.
Contributing author
Kiarie Henry Mbugua
Software engineer building AI systems that are grounded, evaluated, and secure. RAG, MCP, Python, and identity (OAuth, Entra ID). Open to AI engineering roles
Published work
Articles by Kiarie Henry Mbugua
How I built a governed dependency pipeline: no package ships until it earns trust
A case study of a governed open-source intake pipeline: quarantine, Trivy scanning, OPA policy as code, promotion to an approved registry, and SBOM monitoring with Dependency-Track.
Score match quality and load results into Postgres
Use eval/score.py to compute precision, recall, and F1 for a reconciliation run against the ground_truth.json answer key, then optionally load the same run into a Postgres target schema.
Reconcile ERP and CRM records with the pipeline
Run the reconcile CLI to ingest, clean, validate, and resolve ERP and CRM exports into a single crosswalk, quarantine log, and Markdown reconciliation report.
Customize messiness and build a reproducible configuration file
Tune the missing-value, bad-date, encoding, duplicate, orphan, and amount-drift ratios that control how messy a generated dataset is, and save your choices to a config file datagen can replay exactly.
Compare ERP and CRM field mappings and the ground truth answer key
Read the same customer, invoice, and payment across a flat ERP CSV export and a nested CRM JSON export, and learn what the ground_truth.json answer key does, and doesn't, record.
Generate a synthetic ERP and CRM dataset
Use the datagen CLI to produce a reproducible, deliberately messy ERP and CRM export pair, complete with a ground-truth answer key, the foundation every reconciliation lesson in this series runs against.
Test model output with deterministic rules
Add deterministic rule checks to a prompt-evaluation workflow, then measure exactly where simple substring rules produce false positives and false negatives.
Benchmark retrieval quality
Turn six labeled retrieval questions into a repeatable BM25 quality report using Hit@k, Recall@k, and mean reciprocal rank, then use the report to find what lexical retrieval misses.
Merge rankings with Reciprocal Rank Fusion
Combine BM25 and vector rankings with Reciprocal Rank Fusion, promoting chunks found by multiple retrievers without ever comparing their incompatible raw scores.
Build and search a vector index
Build a small exact vector index that stores L2-normalized vectors, ranks results by cosine similarity, and rejects vectors from an incompatible model or dimension.
Implement Okapi BM25 from scratch
Build the keyword-ranking function behind a local retrieval pipeline: preserve identifiers, calculate Okapi BM25 scores, and return deterministic ranked results without a search library.
Chunk Python and Markdown for retrieval
Build the ingestion pipeline that splits Python and Markdown files into stable, citable chunks, the foundation every retrieval guide in this series searches.
Lesson 1: A Step by Step Guide in Passing Data to Excel and Generating a Pie Chart using Python 3.7, Openpyxl and Pandas.
Write data from Python to an Excel workbook with pandas and openpyxl, then generate a pie chart from it. Covers Anaconda setup and Python 3.7.
Lesson 3: A Step by Step Tutorial on How to use V-for directive and render data in an HTML page by Consuming Nasa Neows API using Vue.js Framework 2.6 and Axios.js Promise Based Http Client
Use the Vue.js v-for directive to render a list of near-Earth asteroids from the NASA NeoWs API in an HTML page, with data fetched through Axios.
Lesson 2: A Step by Step Tutorial on How to Refactor Our Vue.js Code and usage of Vue.js dev tools extension in Consuming Nasa Open API using Vue.js Framework 2.6 and Axios.js Promise Based Http Client
Refactor the Vue.js code that consumes the NASA APOD API into cleaner methods, and inspect component data with the Vue.js devtools browser extension.
Lesson 1: A Step by Step Tutorial on How to Consume Nasa Open APIs Using Vue.js Framework 2.6 and Axios.js Promise Based Http Client
Fetch data from the NASA Astronomy Picture of the Day API with Vue.js 2.6 and Axios, and display the image, title, and explanation on a web page.
Lesson 4: A Step by Step Tutorial on How to Register Validation and Confirmation URL’s Integration to M-PESA API Using Laravel 6.9 and PHP 7.3
Register validation and confirmation URLs for M-Pesa C2B payments on the Safaricom Daraja API with Laravel 6.9, and handle the callbacks Safaricom sends.
Lesson 3: A Step by Step Tutorial on How to develop C2B Integration to M-Pesa on Daraja Using Laravel 6.9 and PHP 7.3
Build an M-Pesa customer-to-business (C2B) integration on the Safaricom Daraja API with Laravel 6.9, and store payment transactions in your database.
Lesson 2: A Step by Step Tutorial on How to develop an STK push Integration to M-PESA API Using Laravel 6.9 and PHP 7.3
Send an M-Pesa STK push payment request to a customer's phone from Laravel 6.9 with the Safaricom Daraja API, including access token generation.
Lesson 1: A Step by Step Tutorial on How to Integrate to Safaricom Mpesa API using Laravel 6.9 and PHP 7.3
Start integrating the Safaricom M-Pesa Daraja API with Laravel 6.9: learn how M-Pesa works, create a developer account, and add a sandbox app.
A Step by Step Guide on How to Send Automated Email, attach a PDF Document Using Laravel Task Scheduler in Laravel 6.5 and PHP 7.3
Schedule a Laravel 6.5 task that generates a PDF report with DOMPDF and emails it as an attachment, so management reports send themselves on time.
Lesson 2: A Step by Step Tutorial on How to Create a USSD Menu Business Logic Using Africa’s Talking Gateway in Laravel 5.8 and PHP 7.2.10
Add business logic to a USSD menu built with Laravel 5.8 and Africa's Talking, so each option a user picks leads to the right next screen.
Lesson 3: A Step by Step Tutorial on How to connect our Github Repository with Travis CI in Test-Driven Development Using Django 2.2 and Python 3.7.
Connect a Django 2.2 GitHub repository to Travis CI so your test suite runs on every push, and catch failing tests before they reach production.
Lesson 1: A Step by Step Tutorial on How to Create a USSD Menu Using Africa’s Talking Gateway in Laravel 5.8 and PHP 7.2.10
Build a USSD menu that works on any mobile phone, including feature phones, with the Africa's Talking gateway and Laravel 5.8.
Lesson 2: A Step by Step Tutorial on How to Create a Blog Application in Test-Driven Development Using Django 2.2 and Python 3.7.
Gather requirements as user stories, learn how functional tests differ from unit tests, and start the Django 2.2 blog that you build with TDD.
Lesson 1: A Step by Step Tutorial on How to Use Test Driven Development When Developing Applications Using Django 2.2 and Python 3.7.
Learn what test-driven development is and why writing failing tests first helps you build Django applications that keep working as they change.
Lesson 6: A Step by Step Tutorial on How to Fix Bug on Registering Confirmation and Validation URL’s to M-Pesa C2B Integration on Daraja Using Django 2.2 and Python 3.7
Fix the 409 conflict error that M-Pesa returns when you register C2B confirmation and validation URLs on the Safaricom Daraja sandbox from Django 2.2.
A Step by Step Tutorial on How to Monitor Software Errors in Real-Time Using Sentry in Django Web Applications.
Add Sentry to a Django web application to catch, track, and prioritize production errors in real time, instead of waiting for users to report them.
Lesson 5: A Step by Step Tutorial on How to Register Confirmation and Validation URL’s to M-Pesa C2B Integration on Daraja Using Django 2.2 and Python 3.7
Register M-Pesa C2B confirmation and validation URLs on the Safaricom Daraja API from Django 2.2, and build the views that receive payment callbacks.
Lesson 4: A Step by Step Tutorial on How to develop C2B Integration To M-Pesa On Daraja Using Django 2.2 and Python 3.7
Create the Django 2.2 models and migrations that store M-Pesa payments, and start building a customer-to-business (C2B) integration on Daraja.
Lesson 3: A Step by Step Tutorial on How to do STK Push Integration To M-Pesa On Daraja Using Django 2.2 and Python 3.7
Send an M-Pesa STK push (Lipa na M-Pesa Online) payment request to a customer's phone from Django 2.2 with the Safaricom Daraja API.
Lesson 2: A Step by Step Tutorial on How to Generate Mpesa Access Token Using Django 2.2 and Python 3.7.
Generate an OAuth access token for the Safaricom M-Pesa Daraja API from a Django 2.2 application, the first call every M-Pesa integration makes.
Lesson 1: A Step by Step Tutorial on How to Integrate to Mpesa API Using Django 2.2 and Python 3.7
Start integrating the Safaricom M-Pesa Daraja API with Django 2.2: learn how M-Pesa works, create a developer account, and add a sandbox app.
Lesson 4: A Step by Step guide on Showing Registered Users, activating & deactivating users in Django 2.2 and Python 3.7
List registered users on a custom Django 2.2 dashboard, and let administrators activate or deactivate each account with a single click.
Lesson 3. A Step by Step guide on Creating Custom Dashboard and Login User in Django 2.2 and Python 3.7.
Build a custom dashboard in Django 2.2, redirect users there after they register, and add a sign-in view with the built-in authentication system.
Lesson 2: A Step by Step Guide on How to Use Bootstrap and Register User in Django 2.2 Authentication System and Python 3.7
Style a Django 2.2 project with the Bootstrap front-end framework, and build a registration form that creates users with the built-in auth system.
Lesson 1: A Step by Step Guide on How To Use Django 2.2 Authentication System and Python 3.7
Set up a Django 2.2 project and learn how the built-in authentication system handles user accounts, permissions, sessions, and passwords.
A Step by Step guide on how to use Gitflow in Software Development
Learn what Gitflow is and why its branching model helps teams ship, then install it on Windows, Linux, or macOS and use it on a real Git project.
Lesson 1: A Step by Step Guide to Learning Data Science Using Python
Learn what data science is, see how hotels and insurers use it to make decisions, and get started with the Python tools you need for data analysis.
A Step by Step guide on how to use Git and Github
Learn what Git is and why version control matters, then create a repository, commit changes, and push your code to GitHub step by step.
Part X: Displaying Our Posts to Site Visitors in Laravel 5.7 and Php 7.2
Build the public landing page for a Laravel 5.7 blog application, so site visitors can browse published posts and read each one in full.
Learn How to Do Web Scraping Using Python 3.7 and Beautiful Soup 4
Scrape blog posts from a website with Python 3.7, Requests, and Beautiful Soup 4, then write the titles and links you extract to a CSV file.
Part IX: How to Delete a Post and Final Admin Dashboard Touch in Laravel 5.7 and Php 7.2
Let authors delete posts from the admin dashboard of a Laravel 5.7 blog application, with a delete route, a controller method, and Eloquent.
Part VIII: How to Edit and Update Our Post in Laravel 5.7 and Php 7.2
Let authors edit and update existing posts in a Laravel 5.7 blog application, with a prefilled form, validation, and an update route.
Part VII: How to Upload Image in Our Blog Application Using Laravel 5.7 and Php 7.2
Add image uploads to a Laravel 5.7 blog: validate the file, store it on disk, save its path with the post, and display the image on the page.
Part VI: How to store and Retrieve a Blog Post in Laravel 5.7 and Php 7.2
Validate and save new blog posts with Eloquent in Laravel 5.7, then show a success message and list the stored posts in the admin dashboard.
Part V: Running Our Blog Migration and Creating Blog Post in Laravel 5.7 and Php 7.2
Run the blog posts migration in Laravel 5.7 and build the form that authors use to create a new blog post from the admin dashboard.
Part IV: Creating Blog Migration and Showing Registered Users in Our Admin Portal Using Laravel 5.7 and Php 7.2
Create the posts table migration for a Laravel 5.7 blog, and query registered users to list them in the Bootstrap 4 admin portal.
Part III: Using Bootstrap 4 on our Blog Admin Dashboard in Laravel 5.7 and Php 7.2
Build the admin dashboard for a Laravel 5.7 blog application with Bootstrap 4, so authors who sign in can manage posts and users from one place.
Part II: Creating Blog Admin Portal Using Laravel 5.7 and Php 7.2
Add authentication to a Laravel 5.7 blog with the built-in scaffolding, so authors can register, sign in, and reach the admin portal.
Part II: How to Sign up User and Send confirmation Email in Django 2.1 and Python 3.6
Build a Django 2.1 sign-up form that creates inactive accounts and emails each user a token link to confirm their address and activate the account.
Part I: Email verification upon sign up in Django 2.1 and Python 3.6
Set up a Django 2.1 project for email verification on sign-up, and learn why confirming that users own their email address protects your application.
Part 1: Building A Blog Application Using Laravel 5. 7 and Php 7.2
Set up a Laravel 5.7 project for a blog application with user sign-in, an admin panel for posts and users, image uploads, and comments.
How to Become a Better Software Developer – Our Thought
Grow as a software developer with three habits: practice by building small projects, question existing best practices, and discuss and share your work.