Beginner Ai Engineer: Am I Overengineering My Enterprise Rag Architecture?

I'm a beginner AI engineer and currently the only person on my team working on a chatbot/RAG project for a client. I'm trying to figure out whether I'm approaching this the right way or if I'm overengineering the solution.

The company wants a chatbot over a growing set of business documents, but the requirements are still evolving. New documents keep getting added, some documents don't explicitly answer user questions, and some answers require combining information from multiple documents. A lot of the content is written as broad guidelines rather than direct Q&A, so retrieval is becoming challenging.

One important constraint is that the client does not want their proprietary documents to be exposed to external chatbots or external AI services. They also don't want external users to have direct access to the underlying document repository. So whatever we build needs to stay within the approved environment and only expose authorized, grounded responses.

We're primarily using the Microsoft ecosystem, and I'm allowed to use Copilot Studio. The chatbot will be used by both internal users and external users through an existing custom web portal.

The architecture I'm currently considering looks something like this:

Custom web portal → Embedded Copilot Studio chat → Custom Retrieval API → Azure AI Search → Indexed approved documents → Filtered snippets + citations → Grounded response

The idea is that the Retrieval API handles all the logic before the LLM sees anything:

• Permission filtering
• Metadata filtering (document type, product/category, state, effective dates, etc.)
• Retrieving from multiple sources when needed
• Returning only approved snippets with citations
• Refusing to answer when no authorized source supports the response, or escalating to a human

Some of the challenges I'm trying to solve are:

• Documents that are vague and don't explicitly answer user questions
• Questions whose answers span multiple documents
• Document versioning and effective dates
• Keeping retired documents out of search
• Reliable citations
• Better chunking for Word documents, PDFs, manuals, and tables
• Evaluation of retrieval quality
• Supporting external users without exposing the document repository directly

The downside is that this is obviously much more engineering than simply connecting Copilot Studio to a document library. I'd have to build and maintain ingestion, indexing, metadata, retrieval, evaluation, and permission filtering.

I also asked about getting access to Claude as a development assistant (only for architecture discussions, design ideas, and synthetic examples not for uploading or analyzing client documents). However, the request will likely be declined because the client does not want their documentation to be exposed to external AI services. They were initially hesitant to even move their documents to the cloud, so I completely understand and respect their concerns.

So now I'm wondering whether I'm spending too much time designing for scalability this early, or whether these are the kinds of problems that should be solved from the beginning.

For those of you who've built enterprise RAG systems:

• Does this architecture make sense?
• Would you approach it differently?
• Is there a simpler or more maintainable architecture that still scales well?
• Would you rely more heavily on native Copilot Studio capabilities, or is a custom retrieval layer the better long-term approach?
• Are there any architecture patterns or best practices that I'm missing?

I'd also really appreciate any recommendations for blog posts, GitHub repositories, Microsoft architecture guides, conference talks, YouTube channels, courses, or other learning resources that cover enterprise RAG, Copilot Studio, Azure AI Search, retrieval evaluation, document ingestion, and production-ready architectures. Since I'm the only engineer on this project, having good references to learn from would be incredibly helpful.

Also, if you happen to see this post across multiple subreddits, I apologize in advance. I'm cross-posting because I'm hoping to get feedback from people with different backgrounds (RAG, Azure, Copilot Studio, enterprise architecture, etc.) and would really appreciate as much guidance as I can get.

Thanks in advance for any suggestions or feedback!