---
title: "RAG vs Agentic: What Actually Separates the Two, in Vendor Documentation"
description: "A RAG assistant retrieves documents and writes an answer. An agentic one can also call tools that change a system of record, which is why it ships an approval gate. A three-part test from Glean, Atlassian and Microsoft admin docs, plus what the benchmarks say retrieval does and does not fix. Verified 6 September 2026."
url: "https://ainora.lt/blog/rag-vs-agentic-internal-ai-assistant"
published: "2026-09-06"
author: "Justas Butkus"
---

# RAG vs Agentic: What Actually Separates the Two, in Vendor Documentation

**A RAG assistant retrieves documents from your systems and writes an answer: it only reads. An agentic assistant can also call tools that change a system of record, which is why it has to ship an approval gate and a control for switching that gate off.** Everything else vendors say about autonomy sits downstream of those two sentences.

That definition is not ours. It is assembled from three vendors' administrator documentation, and each clause below is quoted from the page it came from. The reason to prefer administrator docs to marketing pages is simple: a marketing page describes what a product is for, and an administrator page has to describe what happens when it goes wrong.

Every quotation on this page was read from the vendor page or the paper it is attributed to, on **6 September 2026**. Where a source could not support a number, the number is absent and the reason is stated in the last section.

## What Is the Difference Between a RAG Assistant and an Agentic One?

One difference, with three observable consequences. **A RAG assistant reads. An agentic assistant reads and writes.** Everything else follows from that: because it can write, it needs a planner to decide which action to take; because it can write, it needs a confirmation step; and because that confirmation step is annoying, it needs a setting for removing it, which is where the governance question lives.

Notice what is *not* in that definition. Nothing about model size, nothing about reasoning, nothing about how many steps something takes internally. A retrieval system can chain twenty internal steps and still only ever hand you text. An agent can be one step long and still change a record. The number of steps is a performance characteristic. The write surface is an architectural one, and it is the only part of this that shows up in a risk register.

## Where Does RAG Actually Come From?

From a specific paper, which is unusual in this field and worth using. Lewis and colleagues published *Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks* as arXiv:2005.11401, accepted at NeurIPS 2020. The abstract:

> **The origin of the term, verbatim**
>
> “We explore a general-purpose fine-tuning recipe for retrieval-augmented generation (RAG) -- models which combine pre-trained parametric and non-parametric memory for language generation. We introduce RAG models where the parametric memory is a pre-trained seq2seq model and the non-parametric memory is a dense vector index of Wikipedia, accessed with a pre-trained neural retriever.”
>
> [Source: arXiv:2005.11401, Lewis et al., NeurIPS 2020](https://arxiv.org/abs/2005.11401)

Two words in there carry the architecture. **Parametric** memory is what the model learned during training and cannot change without retraining. **Non-parametric** memory is an index you can rebuild this afternoon. RAG is the recipe for letting the second one inform the first at answer time. That is all it is, and it is the reason a company can point a model at its own documents without training anything.

The same abstract also names, in one sentence, the two problems the technique was created to attack. Both are precisely what a company buys an internal assistant to solve:

> **The two open problems RAG was aimed at**
>
> “Additionally, **providing provenance for their decisions and updating their world knowledge remain open research problems.**”
>
> [Source: arXiv:2005.11401, Lewis et al., NeurIPS 2020](https://arxiv.org/abs/2005.11401)

Provenance is being able to show where an answer came from. Updating world knowledge is not being stuck with what the model learned in training. Note the framing the authors chose in 2020: these are open research problems. Six years later, several sections of this page are about how open they still are.

**The defining property, and the one that makes the whole comparison tractable: the system reads. It does not write.**

## What Does an Agentic Assistant Do That a RAG One Cannot?

Marketing frames agentic as autonomy, which is unfalsifiable and therefore useless in a procurement conversation. The architecturally honest difference is narrower, much more useful, and visible in administrator documentation: an agentic assistant can call **write tools** that change a system of record, and the product therefore has to ship an **approval gate** and a control for removing it.

Glean states this outright on the admin page that governs the setting.

> **Glean, on running write tools without a confirmation step**
>
> “With in-line execution enabled, eligible write tools in interactive agents can execute automatically without showing a confirmation step.”“When tools are enabled to run without user confirmation, Glean automatically executes the tool based on AI-predicted values and **might update the system of record**.”“Admins determine which tools are allowed to run without confirmation.”“End users must grant consent for an agent to execute allowed tools without a confirmation step. During consent, users can review what permissions or tools the agent may perform.”“Some tools may always require confirmation due to risk or policy.”
>
> [Source: Glean docs, allowing in-line execution of write tools](https://docs.glean.com/administration/tools/managing-tools/allowing-in-line-execution-of-write-tools)

**“Might update the system of record” is the line.** It is the entire distinction between RAG and agentic, written by a vendor, in an operational document, with the risk stated plainly rather than sold. Read the surrounding clauses as a set and you have the governance model too: the vendor supplies a gate, an administrator decides which tools may bypass it, a user consents to the bypass, and some actions can never be bypassed at all. Four different parties, each with a defined role, for the single act of letting software change a record without asking first.

Glean's own security page frames the same boundary from the risk side, listing enforcement of “source-system permissions on every read and write” and noting that “an agent should not automatically access everything the user can”, alongside a control point for checking “agent actions against the user’s intent and authority before execution”. Which is a vendor saying, in its own words, that write access makes the permission question harder rather than the same. That is the subject of a companion piece on [why an internal AI assistant surfaces documents people were never meant to find](/blog/internal-ai-assistant-permission-leakage), and the two problems compound: an agent that can reach the wrong document can also act on it.

## Which Vendor Draws the Read and Write Line Most Cleanly?

Atlassian, and it does it in a plain component list rather than an argument. Its documentation enumerates the parts an agent is made of, and the last two are the ones that matter here:

> **Atlassian, on what an agent is made of**
>
> “Agents are made up of parts that work together to give you helpful answers and take action on your behalf.**Knowledge:** the data the agent can reference, such as content from Confluence, Jira, or external systems.**Skills:** actions that your agent is allowed to take, such as draft a Confluence page or send Slack messages.”
>
> [Source: Atlassian Support, what are agents](https://support.atlassian.com/studio/docs/what-are-agents/)

**Knowledge and Skills are separate, separately-permissioned components, and RAG is the Knowledge half only.** That is the cleanest one-sentence articulation of the distinction available from any vendor in this field, and it has a practical consequence a buyer can use immediately: if a product has no screen where actions are defined and permissioned, it does not have the Skills half, whatever the homepage says.

## Where Does the Autonomy Actually Come From?

Not from the model. From an administrator, and Atlassian says so in one sentence that is worth pinning to the wall of any procurement meeting:

> **Atlassian, on how agents become autonomous**
>
> “For agents to work autonomously, they must be managed through your existing Confluence space or Jira Project administrators via an automation rule. **Without automations and setup from an admin, agents can’t work autonomously.**”
>
> [Source: Atlassian Support, agents in automations](https://support.atlassian.com/rovo/docs/agents-in-automations/)

This deflates most of the anxiety and most of the hype in the same move. An agent does not decide to start acting on its own. Somebody with administrative rights connects it to an automation rule, and until they do, it waits to be asked. It also relocates the risk to somewhere a company can actually manage it: the question is not whether the model is trustworthy, it is which four people in your organisation can arm one, and whether anybody reviews what they arm.

Microsoft's definition names the same two halves and adds the planner explicitly. From its Copilot Studio fundamentals page: an agent “follows the instructions you give it, draws on the knowledge sources you connect, and uses tools to take action”. Knowledge and tools, again. On the planning behaviour, the same page: it “interprets the request, chooses the right tools, and works through the steps needed to complete the task”, and separately, “so you don’t have to script every path.” Microsoft also notes that its workflows “include built-in testing and human-in-the-loop controls for enterprise-ready automation”, which is the same approval gate under a different name.

| Dimension | RAG assistant | Agentic assistant |
| --- | --- | --- |
| What it does with your systems[Source: Glean docs, allowing in-line execution of write tools](https://docs.glean.com/administration/tools/managing-tools/allowing-in-line-execution-of-write-tools) | Reads. Retrieval feeds passages to a generator, which writes an answer. | Reads and writes. Glean: with in-line execution on, the product “automatically executes the tool based on AI-predicted values and might update the system of record.” |
| The component list[Source: Atlassian Support, what are agents](https://support.atlassian.com/studio/docs/what-are-agents/) | An index and a generator. Lewis et al. describe “a pre-trained seq2seq model” plus “a dense vector index of Wikipedia, accessed with a pre-trained neural retriever.” | Atlassian separates them by name: “Knowledge: the data the agent can reference” and “Skills: actions that your agent is allowed to take, such as draft a Confluence page or send Slack messages.” |
| How the steps are chosen[Source: Microsoft Learn, what is Copilot Studio](https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio) | A fixed path. Retrieve, then generate. | A planner. Microsoft: it “interprets the request, chooses the right tools, and works through the steps needed to complete the task”, and separately, “so you don’t have to script every path.” |
| The human in the loop[Source: Glean docs, allowing in-line execution of write tools](https://docs.glean.com/administration/tools/managing-tools/allowing-in-line-execution-of-write-tools) | Implicit. The human reads the answer and decides what to do with it. | Explicit and configurable. Glean: “Admins determine which tools are allowed to run without confirmation” and “End users must grant consent for an agent to execute allowed tools without a confirmation step.” |
| Where autonomy comes from[Source: Atlassian Support, agents in automations](https://support.atlassian.com/rovo/docs/agents-in-automations/) | It does not have any. Somebody asked a question. | An administrator. Atlassian: “Without automations and setup from an admin, agents can’t work autonomously.” |
| What goes wrong | A wrong or stale answer that a person may act on. | A wrong answer that has already been written into a record before a person sees it. |

## The Three-Part Test for RAG or Agentic

Everything above collapses into three questions. Each one is answerable from a vendor's own documentation in under ten minutes, and each clause of the test is quoted from a source cited on this page.

**The three-part test for whether an AI assistant is RAG or agentic**

1. **1. Is there a separate, separately-permissioned write surface?** - Ask to see the object in the admin console where actions are defined, not the demo. Atlassian names it as its own component: “Skills: actions that your agent is allowed to take, such as draft a Confluence page or send Slack messages.” Microsoft calls it “tools to take action”. A pure RAG system has no such object at all, so if nobody can show you the screen where actions are listed and permissioned, the product is retrieve-and-answer with an agentic label on it. (Source: Atlassian Support, what are agents - https://support.atlassian.com/studio/docs/what-are-agents/)
2. **2. Is there a planner that chooses steps, rather than a fixed retrieve-then-generate path?** - Microsoft describes the planning behaviour directly: the agent “interprets the request, chooses the right tools, and works through the steps needed to complete the task”, and adds “so you don’t have to script every path.” Lewis et al. 2020, the paper that defined RAG, has no such component: retrieval feeds a generator and the path never varies. Ask what happens when the first step fails. A planner tries something else. A pipeline returns a bad answer. (Source: Microsoft Learn, what is Copilot Studio - https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio)
3. **3. Who can remove the human confirmation gate?** - This is the question with the operational and legal consequences, and it is the one demos never cover. Glean documents both halves: “Admins determine which tools are allowed to run without confirmation”, and “End users must grant consent for an agent to execute allowed tools without a confirmation step.” Some actions are exempt from removal entirely: “Some tools may always require confirmation due to risk or policy.” Atlassian puts the same power with an administrator: “Without automations and setup from an admin, agents can’t work autonomously.” Get the answer in writing, because it decides who is accountable when a record changes and nobody clicked anything. (Source: Glean docs, allowing in-line execution of write tools - https://docs.glean.com/administration/tools/managing-tools/allowing-in-line-execution-of-write-tools)

> **The buyer-facing version, in one sentence**
>
> **A product being called an agent tells you nothing. Ask whether it can write into a connected system, whether it plans its own steps, and who is allowed to switch off the confirmation.**

The three answers also price the project, which is the part nobody mentions in a demo. A no on all three means you are buying search with a language model on top, and the work is retrieval quality and permissions. A yes on the first two and a vague answer on the third means somebody in your organisation is about to become accountable for changes nobody approved, and the work is a control model before it is a rollout.

## Where Is the Distinction Marketing Rather Than Architecture?

Two observations, both sourced, and both reasons the word on the box is not evidence.

**Every vendor in this field now calls its product agentic, including ones whose documented behaviour is retrieve-and-answer.** Glean's own navigation sells “Enterprise search” and “Glean Agents” as two separate products under one brand, which is honest labelling and also proof that the adjective does not tell a buyer which one they are getting.

**Microsoft concedes on its own page that “agent” spans two different architectures.** The Copilot Studio fundamentals page describes one harness where “the agent uses natural language understanding to match a request to the best topic”, a topic being “a portion of a conversation you design with connected steps, questions”. That is topic matching against a design somebody authored, and it sits on the same page as the planning behaviour quoted earlier. One word, two products, one vendor, one document.

> **A note on how this page was sourced, because it changes what you can trust**
>
> Glean's agentic claims appear in a press release describing an “agentic reasoning engine” and “a library of actions”. We do not quote it, for one reason: the library is undefined there and the developer documentation page for the action taxonomy returns HTTP 404. What does resolve, and what this page cites instead, is the administrator page that documents the actual mechanism, including who may switch off the confirmation step. When a capability appears in a press release and not in an admin doc, the admin doc is the one that tells you what you are buying.

## Does Retrieval Fix Accuracy? What the Studies Measured

This matters for the RAG-or-agentic decision because of an ordering argument: reading is the easier half, and reading is not solved. Three benchmarks with real samples make that concrete.

**The myth first, because three named vendors published it.** A Stanford RegLab and HAI team noted that legal research providers had described retrieval-augmented generation as “eliminating” or “avoid[ing]” hallucinations, or guaranteeing “hallucination-free” citations. They then ran the first preregistered empirical evaluation of those tools:

> **The preregistered test of a vendor claim**
>
> “We demonstrate that the providers’ claims are overstated. While hallucinations are reduced relative to general-purpose chatbots (GPT-4), we find that the AI research tools made by LexisNexis (Lexis+ AI) and Thomson Reuters (Westlaw AI-Assisted Research and Ask Practical Law AI) **each hallucinate between 17% and 33% of the time**.”**Sample and method:** a preregistered dataset of 202 legal queries. Twenty were taken verbatim from LegalBench’s Rule QA task and twenty verbatim from bar-exam prep questions; the rest were hand-written or adapted. **The authors state their own limitation, and it belongs with the number:** “although we designed the first benchmark dataset, the sample size of 202 queries remains small in comparison to other evaluations.” This measures legal research tools, not internal company assistants, and should be cited as such.
>
> [Source: arXiv:2405.20362, Stanford RegLab and HAI](https://arxiv.org/abs/2405.20362)

Two things are true at once there, and dropping either one produces a dishonest page. RAG *did* reduce hallucination relative to a general-purpose chatbot. And three vendors sold “eliminates” against a measured 17% to 33%. The useful lesson is not that retrieval fails. It is that the gap between a vendor's absolute claim and an independent measurement was large enough to be worth 202 hand-written queries to expose.

**CRAG measures the same thing at scale, outside law.** The Comprehensive RAG Benchmark, the basis of the KDD Cup 2024 challenge, is built on 4,409 question-answer pairs with mock search and knowledge-graph APIs, spanning five domains and eight question categories, with entity popularity running from head to long tail and temporal dynamism from years to seconds. Its headline is quotable and unflattering: most advanced models reach **≤34%** accuracy on it, and adding RAG in a straightforward way improves that only to 44%.

- **63%** - of questions that state-of-the-art industry RAG solutions answer without any hallucination, on the 4,409-pair CRAG benchmark (Source: arXiv:2406.04744, CRAG benchmark - https://arxiv.org/abs/2406.04744)
- **17% to 33%** - hallucination rate measured in legal RAG tools whose vendors had described RAG as eliminating hallucination, n = 202 preregistered queries (Source: arXiv:2405.20362, Stanford RegLab and HAI - https://arxiv.org/abs/2405.20362)
- **Over 60%** - of the time that models adopt incorrect retrieved content over their own correct prior knowledge, across six domains and six models (Source: arXiv:2404.10198, ClashEval - https://arxiv.org/abs/2404.10198)
- **58% to 35%** - single-turn to multi-turn success for leading LLM agents acting inside a business system on CRMArena-Pro (Source: arXiv:2505.18878, CRMArena-Pro - https://arxiv.org/abs/2505.18878)

The 63% figure is the one to take into a business case, because it is measured on industry systems rather than research prototypes: **“State-of-the-art industry RAG solutions only answer 63% of questions without any hallucination.”** And the paper adds a finding that matters more for an internal knowledge base than for a web benchmark. CRAG “reveals much lower accuracy in answering questions regarding facts with higher dynamism, lower popularity, or higher complexity”. Dynamism means how fast the fact changes. That is the closest published proxy for the stale-document problem in a company wiki, and it says the questions your staff actually ask, about the policy that changed last quarter, are the ones retrieval handles worst.

**ClashEval explains why a wrong document is worse than no document.** The authors curated over 1,200 questions across six domains, applied controlled perturbations to the retrieved content ranging from subtle to blatant, and benchmarked six top-performing models. The result: models are “susceptible to adopting incorrect retrieved content, overriding their own correct prior knowledge over 60% of the time.” In other words, the model often knew the right answer and abandoned it because a retrieved passage disagreed.

**The honest limit on that one, stated because it changes how much weight it carries:** ClashEval's domains are drug dosages, Olympic records and locations. Not internal wikis. It is strong evidence about the mechanism, and it is not a measurement of what happens in your document store. Anybody quoting it as an intranet failure rate is over-reaching, and we are not going to do that here in order to make a paragraph land harder.

**And a citation is not proof of use.** Wallat and colleagues separate citation correctness, whether a cited document supports the statement, from citation faithfulness, whether the model actually relied on it. Faithfulness, in their definition, “ensures that the model’s reliance on cited documents is genuine, reflecting actual reference use rather than superficial alignment with prior beliefs, which we call post-rationalization.” They report that attributed answers often lack faithfulness, with an upper bound of up to 57 percent of citations. That is an upper bound across conditions with no sample stated in the abstract, so it is not a rate and we do not present it as one. The transferable idea is that a footnote in an assistant's answer is weaker evidence than it looks.

## The Evidence Table

Everything cited above, with its sample and how much weight it will carry.

| Study | Year | Sample | Key finding | Confidence and limits |
| --- | --- | --- | --- | --- |
| Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks”[Source: arXiv:2005.11401, Lewis et al., NeurIPS 2020](https://arxiv.org/abs/2005.11401) | 2020 | Open-domain QA benchmarks over a dense vector index of Wikipedia | Defines RAG as parametric plus non-parametric memory, and names the two problems it was invented for: “providing provenance for their decisions and updating their world knowledge remain open research problems.” | High. Peer-reviewed at NeurIPS 2020 and the origin of the term. |
| Magesh, Surani, Dahl, Suzgun, Manning, Ho, “Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools”[Source: arXiv:2405.20362, Stanford RegLab and HAI](https://arxiv.org/abs/2405.20362) | 2024 | n = 202 preregistered legal queries, including 20 taken verbatim from LegalBench Rule QA and 20 verbatim bar-exam questions | Three vendors claimed RAG “eliminating” or “avoid[ing]” hallucinations. Measured, the tools “each hallucinate between 17% and 33% of the time.” | High for the tools and period tested. The authors state their own limit: “the sample size of 202 queries remains small in comparison to other evaluations.” Legal research, not internal company documents. |
| CRAG, Comprehensive RAG Benchmark[Source: arXiv:2406.04744, CRAG benchmark](https://arxiv.org/abs/2406.04744) | 2024 | n = 4,409 question-answer pairs, five domains, eight question categories, entity popularity from head to long tail | Most advanced models reach ≤34% accuracy; adding RAG straightforwardly takes it to 44%. “State-of-the-art industry RAG solutions only answer 63% of questions without any hallucination.” Accuracy is lower “regarding facts with higher dynamism, lower popularity, or higher complexity.” | High for the benchmark. It is web and knowledge-graph question answering, not a company wiki. |
| ClashEval, quantifying the tug-of-war between an LLM’s internal prior and external evidence[Source: arXiv:2404.10198, ClashEval](https://arxiv.org/abs/2404.10198) | 2024 | n ≥ 1,200 curated questions across six domains, controlled perturbations from subtle to blatant, six top-performing models | Models are “susceptible to adopting incorrect retrieved content, overriding their own correct prior knowledge over 60% of the time.” | High for the mechanism. The honest limit: the domains are “drug dosages, Olympic records, locations”, not internal wikis. Cite it for how retrieval fails, not for a rate in your systems. |
| CRMArena-Pro[Source: arXiv:2505.18878, CRMArena-Pro](https://arxiv.org/abs/2505.18878) | 2025 | Nineteen expert-validated tasks across sales, service and configure-price-quote, business-to-business and business-to-consumer, plus 80 confidentiality-awareness queries per organisation | Leading agents reach “only around 58% single-turn success”, dropping to roughly 35% multi-turn, and “agents exhibit near-zero inherent confidentiality awareness; though targeted prompting can improve this, it often compromises task performance.” | Medium to high. Vendor-affiliated: the authors are at Salesforce AI Research and the environment is a Salesforce org. The findings are unflattering to agents, which cuts against the usual bias. |
| Wallat et al., “Correctness is not Faithfulness in RAG Attributions”[Source: arXiv:2412.18004, Wallat et al., ICTIR 2025](https://arxiv.org/abs/2412.18004) | 2024, ICTIR 2025 | Not stated in the abstract | Citing a source is not the same as having used it. “Current attributed answers often lack citation faithfulness (up to 57 percent of the citations)”, where unfaithful means “superficial alignment with prior beliefs, which we call post-rationalization.” | Low for any rate. The figure is an upper bound across conditions with no sample stated, so it belongs in an argument about mechanism and never as a headline number. |

## Which One Should You Buy First?

Read first, write later, and the evidence rather than caution is the reason.

**1. A wrong answer is cheap and a wrong write is not.** In a read-only deployment, the human is the gate by construction. Once a tool can update a record, an error is committed before anybody reviews it, and the numbers above say errors are not rare: 63% hallucination-free on the industry systems CRAG tested, and around 58% single-turn success dropping to roughly 35% multi-turn for agents acting inside a business system.

**2. Find out where retrieval fails in your own documents before you automate on top of it.** CRAG's dynamism finding predicts where: the material that changes often. Run the read-only phase against the questions your staff actually ask, and count how often the assistant answers from a superseded version. That count is the real readiness measure, and it is specific to your document estate in a way no benchmark can be.

**3. Add write tools one at a time, each behind a confirmation.** The vendors have built exactly this. Glean documents that administrators choose which tools may run unconfirmed, that users must consent, and that “some tools may always require confirmation due to risk or policy”. Use the gate as designed and remove it only where a wrong action is cheap to reverse. Drafting a page is cheap to reverse. Sending an external email is not.

**4. Decide who may arm autonomy, and write it down.** Atlassian's sentence is the whole governance question in fourteen words: without automations and setup from an admin, agents cannot work autonomously. So name the administrators, and make arming an agent a change with a reviewer, in the same way granting production database access is.

**5. Keep the permission question in front of the capability question.** An agent inherits its reach from the same access controls a read-only assistant does, and then acts on it. If the underlying permissions have never been reviewed, adding write tools multiplies a problem rather than introducing a new one.

This is how we sequence an [AI teammate for a European company](/ai-teammate): read-only against a named set of systems first, then one write action at a time, each with a confirmation until the evidence says the confirmation is not earning its place. It is a slower start and a shorter list of incidents. Pricing is individual, because the shape of the integration work is different in every company and a per-seat number would be a guess about somebody else's systems.

Two adjacent questions get decided at the same time as this one, and they are answered in different documents. What the vendor does with the content you send it is covered tier by tier in [does your AI vendor train on your data](/blog/does-your-ai-vendor-train-on-your-data), and where the processing physically happens is covered in [whether an internal assistant’s EU data residency covers the AI](/blog/internal-ai-assistant-eu-data-residency-2026). If the business case rests on how much time staff spend hunting for documents, check the provenance of that number first: we traced it in [the hours-wasted-searching statistic and where it actually comes from](/blog/hours-wasted-searching-for-information-studies).

## What This Page Does Not Claim

> **Last verified 6 September 2026**
>
> Every quotation above was read from the page or paper it is attributed to on 6 September 2026. Vendor administrator documentation changes without changelogs, and the settings described here govern whether software may change your records without asking, so re-open the links before you rely on them. Where a doc has moved or a claim has changed, the paragraph is corrected and this date moves with it.

- **No hallucination rate for internal company assistants.** None of the studies cited here measured one. The legal figure is legal, the CRAG figure is web and knowledge-graph question answering, and the ClashEval domains are drug dosages, Olympic records and locations. Each is labelled with what it actually tested, and none of them is quietly upgraded into a number about your intranet.
- **No headline use of the 57 percent citation-faithfulness figure.** It is an upper bound across conditions and the abstract states no sample, so it appears here as a concept with its limit attached and never as a rate.
- **No quotation of Glean’s agentic press release.** Its “library of actions” is undefined there and the developer page for the action taxonomy returns HTTP 404. The Glean material on this page comes from the administrator documentation that does resolve.
- **No measurement of stale content in enterprise assistants.** No independent study we could find measures how often an internal assistant answers from an outdated document. What is verifiable is that vendors sell a manual verification layer as the remedy, which implies the retrieval layer alone does not solve it, and that CRAG measured lower accuracy on facts with higher dynamism. Both are stated as what they are.
- **No certification claims for Ainora.** Several vendors named on this page publish SOC 2 Type II, ISO 27001 and ISO 42001. **Ainora holds no SOC 2 and no ISO certification of any kind.** On that measure they document more than we do, and it would be worthless to you if we implied otherwise.

## Frequently Asked Questions

**What is the difference between a RAG assistant and an agentic one?**

A RAG assistant retrieves documents from your systems and writes an answer. It only reads. An agentic assistant can additionally call tools that change a system of record, which is why every serious agentic product ships an approval gate and a setting for removing it. Glean puts the difference in one clause of an administrator page: with in-line execution enabled, the product “automatically executes the tool based on AI-predicted values and might update the system of record.” Retrieval-augmented generation, as defined by Lewis et al. in 2020, has no equivalent component. So the honest test is not how autonomous something sounds. It is whether there is a write surface, a planner, and a documented answer to who may switch the confirmation step off. (Source: Glean docs, allowing in-line execution of write tools - https://docs.glean.com/administration/tools/managing-tools/allowing-in-line-execution-of-write-tools)

**Where does RAG actually come from?**

From a 2020 paper by Lewis and colleagues, accepted at NeurIPS 2020 and published as arXiv:2005.11401. The abstract describes “a general-purpose fine-tuning recipe for retrieval-augmented generation (RAG), models which combine pre-trained parametric and non-parametric memory for language generation,” where the non-parametric memory is “a dense vector index of Wikipedia, accessed with a pre-trained neural retriever.” The same abstract names the two problems the technique was invented to attack, and both are exactly what a company buys an internal assistant for: “providing provenance for their decisions and updating their world knowledge remain open research problems.” Provenance means being able to show where an answer came from. Updating world knowledge means not being stuck with what the model learned in training. (Source: arXiv:2005.11401, Lewis et al., NeurIPS 2020 - https://arxiv.org/abs/2005.11401)

**Does RAG eliminate hallucination?**

No, and the best-sampled test of that claim was run against vendors who made it. A Stanford RegLab and HAI team ran the first preregistered evaluation of AI legal research tools after providers described RAG as “eliminating” or “avoid[ing]” hallucinations. Their finding: the tools from LexisNexis and Thomson Reuters “each hallucinate between 17% and 33% of the time.” The sample was 202 hand-built legal queries, and the authors state their own limitation plainly, that “the sample size of 202 queries remains small in comparison to other evaluations.” Two qualifications belong with the number when you use it. It measures legal research tools, not internal company assistants. And it still found hallucinations reduced relative to a general-purpose chatbot, so the finding is that RAG helps and does not eliminate, which is a different sentence from either side of the marketing argument. (Source: arXiv:2405.20362, Stanford RegLab and HAI - https://arxiv.org/abs/2405.20362)

**If the assistant retrieves a document, will it trust the document over itself?**

Usually yes, and that is the failure mode people underestimate. ClashEval curated over 1,200 questions across six domains, perturbed the retrieved content with errors ranging from subtle to blatant, and benchmarked six leading models. The models proved “susceptible to adopting incorrect retrieved content, overriding their own correct prior knowledge over 60% of the time.” The honest limit: the domains are drug dosages, Olympic records and locations, not internal wikis, so treat it as evidence about the mechanism rather than a rate for your intranet. The practical consequence is straightforward. A retrieval layer pointed at an out-of-date policy folder does not produce a hedged answer. It produces a confident wrong one with a citation attached. (Source: arXiv:2404.10198, ClashEval - https://arxiv.org/abs/2404.10198)

**Does a citation mean the model used that document?**

Not necessarily, and this is a separate failure from citing the wrong thing. Wallat and colleagues distinguish citation correctness, meaning the cited document supports the statement, from citation faithfulness, meaning “the model’s reliance on cited documents is genuine, reflecting actual reference use rather than superficial alignment with prior beliefs, which we call post-rationalization.” Their finding is that attributed answers often lack faithfulness, with an upper bound of up to 57 percent of citations across their conditions. That is an upper bound with no stated sample, so it should never be quoted as a rate. The usable point is the concept: a footnote proves a document exists, not that the sentence above it came from there. (Source: arXiv:2412.18004, Wallat et al., ICTIR 2025 - https://arxiv.org/abs/2412.18004)

**Is “agentic” a real architectural distinction or a marketing word?**

Both, which is why the test matters. It is real where a vendor documents a write surface, a planner and a consent model, as Glean, Atlassian and Microsoft each do. It is marketing where the same word is applied to retrieve-and-answer. Microsoft concedes the ambiguity on its own page, describing one harness where “the agent uses natural language understanding to match a request to the best topic”, which is topic matching, against the planning behaviour it describes elsewhere on the same page. One word, two products. Glean, meanwhile, sells enterprise search and agents as separate products under one brand. So the word on the box tells a buyer nothing, and the three-part test on this page tells them everything they need. (Source: Microsoft Learn, what is Copilot Studio - https://learn.microsoft.com/en-us/microsoft-copilot-studio/fundamentals-what-is-copilot-studio)

**Should we start with RAG or go straight to agentic?**

Start with reading, for one reason that has nothing to do with ambition: a wrong answer you can see is cheap, and a wrong write is not. The benchmark evidence supports the ordering. CRAG reports that “state-of-the-art industry RAG solutions only answer 63% of questions without any hallucination” on its 4,409-pair sample, and CRMArena-Pro reports leading agents at around 58% single-turn success dropping to roughly 35% across multiple turns. Reading is the easier half and it is not solved. Run the read-only phase against real questions until you know where retrieval fails in your own documents, then add write tools one at a time, each behind a confirmation, and remove the confirmation only where a wrong action is cheap to reverse. (Source: arXiv:2406.04744, CRAG benchmark - https://arxiv.org/abs/2406.04744)

Related on Ainora

Explore the platform and industry pages relevant to this article.

- [AINORA AI voice agentPlatform overview and capabilities](/ai-voice-agent)
- [AI debt collectionCompliant voice for recoveries](/ai-debt-collection)
- [PricingHow we quote per project](/pricing)
- [How it worksSetup, integrations, and go-live](/how-it-works)