Production RAG on the Lakehouse with BigQuery Vector Search and Apache Iceberg A developer argues that conventional RAG architectures create a dangerous chasm between the data lakehouse and the AI stack, forcing teams to duplicate data and reimplement security in a separate vector database. The post details how this separation causes metadata drift, where stale vectors can lead a RAG chatbot to quote outdated prices or recommend recalled products, and security fragmentation, where access revocations in the lakehouse may not propagate to the vector store. The proposed fix is running production RAG directly on the lakehouse using BigQuery Vector Search and Apache Iceberg so vectors stay governed by the source of truth. As teams rush to build with Generative AI, they're creating a dangerous chasm between their data and AI stacks. This common architectural flaw introduces massive technical debt and business risk. The explosion of Generative AI and Building a RAG Context Manager with Apps Script and Gemini Pro https://votuduc.com/building-a-rag-context-manager-with-apps-script-and-gemini-pro-p-20260505625174 RAG has unlocked incredible potential, but it has also exposed a fundamental architectural flaw in how many organizations are building these systems. As teams rush to production, they often inadvertently create a deep chasm between their core data infrastructure and their new AI stack. This divide isn't just an inconvenience; it's a source of significant technical debt, operational complexity, and business risk. At the heart of the issue is the separation of concerns gone awry. The data lives in one universe—the data lakehouse, governed by decades of best practices in security, governance, and reliability. The AI, particularly the vector search component, lives in another—a specialized, often external, database. Bridging this gap requires brittle pipelines, data duplication, and fragmented security models, ultimately undermining the very reliability and trustworthiness we seek to build into our AI applications. The conventional approach to building a RAG system follows a familiar, yet problematic, pattern. You begin with your curated, high-quality data residing in a centralized platform like a data lakehouse. This is your source of truth. To make this data accessible to a Large Language Model LLM , you must: This new silo is completely disconnected from the original data's lifecycle. It has its own infrastructure to manage, its own APIs to learn, and its own failure modes to handle. More importantly, it requires a complex and often fragile synchronization process to keep it from becoming stale. Every time data is updated, deleted, or added in the source system, a corresponding change must be perfectly orchestrated and propagated to the vector database. This adds immense operational overhead and introduces a new, critical point of failure in your AI stack. The consequences of this data silo extend far beyond mere operational complexity. Two critical challenges emerge that directly impact the quality and security of your AI application: metadata drift and security fragmentation. Metadata Drift is the silent killer of RAG system accuracy. It occurs when the data in your source-of-truth lakehouse changes, but those changes aren't immediately and atomically reflected in the vector database. Consider a product catalog table in your lakehouse. A product's price is updated, or its status changes to "recalled." If your synchronization pipeline fails or runs on a delay, your RAG-powered chatbot could retrieve the old, stale context from the vector database and confidently provide a customer with an incorrect price or, worse, recommend a recalled product. This isn't just a technical glitch; it's a direct erosion of user trust and a potential business liability. The vector index has "drifted" from the ground truth, and your RAG system is now hallucinating based on outdated facts. Security Fragmentation presents an equally severe governance and compliance risk. Your enterprise data lakehouse is built upon a robust, unified security model. You have fine-grained controls—IAM roles, row-level access policies, and column-level security—that dictate precisely who can see what data. When you copy that data into a separate vector database, you are forced to reimplement that entire security model from scratch in a new environment. This is not only a duplication of effort but also a massive security risk. It's incredibly difficult to keep two disparate security models perfectly in sync. An employee who leaves the company might have their access revoked in the lakehouse, but their access to the sensitive data copied in the vector store might persist. This fragmentation creates security gaps, doubles the administrative burden, and makes compliance audits a nightmare. What if we could eliminate the divide? What if, instead of moving the data to a separate AI system, we brought the AI capabilities directly to the data? This is the foundational principle of building production-grade AI on the Lakehouse. The modern data lakehouse, combining the scalability of a data lake with the performance and transactional integrity of a data warehouse, is already the established single source of truth for enterprise analytics. It houses your most valuable, curated, and governed data assets. By integrating vector search as a native feature within this platform—as BigQuery has done—we can fundamentally change the architectural paradigm. In this model, vector embeddings are not shipped to an external system; they become just another data type, a new column ARRAY