{"slug": "sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should", "title": "Sahayak — An AI Legal Assistant That Says \"I Don't Know\" When It Should", "summary": "A developer built Sahayak, a RAG-based legal assistant that answers tenancy, consumer-rights and contract questions and summarizes uploaded PDFs in plain language, grounding every response in retrieved context and explicitly refusing to answer when no matching context exists. The system pairs a thin FastAPI retrieval-plus-completion hot path with Groq's openai/gpt-oss-120b model, ChromaDB and sentence-transformers for retrieval, PyMuPDF and pytesseract for parsing, and Groq Whisper for voice input. The developer highlighted guardrails including an untrusted-context system prompt designed to resist prompt injection, python-magic byte-level upload validation, slowapi rate limiting, security headers, and five CI workflows covering lint, pytest, bandit, gitleaks, pip-audit and axe-core.", "body_md": "Legal help is expensive, jargon-heavy, and often out of reach for people who need it most. For PromptWars: Virtual (Exclusive Edition) — a hackathon by Hack2Skill — I built **Sahayak**, a RAG-based legal assistant that answers questions and summarizes documents in plain language, grounded in real context instead of confident guesses.\n\n🔗 Live: [https://legal-ai-eight-liart.vercel.app/](https://legal-ai-eight-liart.vercel.app/)\n\n🔗 Code: [https://github.com/Divyansh0208/Legal-AI](https://github.com/Divyansh0208/Legal-AI) (MIT)\n\n## \n  \n  \n  What it does\n\n- \n**Ask** — a tenancy, consumer-rights, or contract question. Answers are retrieved from indexed context, not hallucinated. No matching context? It says so, instead of guessing.\n- \n**Upload** — a PDF (scanned or native) → plain-language summary: what kind of document it is, what it obligates you to, what's worth double-checking.\n- \n**Voice** — ask by speaking, transcribed via Whisper.\nEvery response is grounded in retrieved context and explicit about what it can't confirm — no confident guessing when the docs don't cover something.\n\n## \n  \n  \n  Architecture\n\nThe RAG hot path is intentionally thin — no framework ceremony for a single retrieval + one chat completion call:\n\n## \n  \n  \n  The part I'm actually proud of: the guardrails\n\nAnyone can wire an LLM to a text box. The parts that took real effort:\n\n- \n**Untrusted-context system prompt** — uploaded documents and retrieved chunks are treated as*data* , never instructions. Prompt-injection resistant by design.\n- \n**Real upload validation** —`python-magic` sniffs actual file bytes; a relabeled`.exe` doesn't sneak through as`.pdf` .\n- \n**Rate limiting** —`slowapi` on query, upload, and voice endpoints.\n- \n**Security headers** — CSP, X-Frame-Options, HSTS in production.\n- \n**5 CI workflows on every push** — lint, pytest, bandit (SAST), gitleaks (secrets), pip-audit (deps), axe-core (a11y) — auto-deploy to Render/Vercel on merge to`main` .\nNone of that shows up in a demo GIF. All of it is why the demo GIF is trustworthy.\n\n## \n  \n  \n  Stack\n\n| Layer | Tech | \n| Backend | FastAPI | \n| LLM | Groq ( `openai/gpt-oss-120b` ) | \n| Retrieval | ChromaDB + sentence-transformers ( `all-MiniLM-L6-v2` ) | \n| Parsing | PyMuPDF, pytesseract | \n| Speech | Groq Whisper | \n| Frontend | React + Vite, Tailwind | \n| DB | SQLite | \n| Deploy | Render + Vercel | \n\n## \n  \n  \n  What's next\n\n- Multi-language support (deferred)\n- Persisted chat sessions (currently in-memory)\n- More jurisdiction-specific templates\nIf you've hit a real legal-access gap, or want to poke holes in the grounding/refusal behavior — feedback welcome. MIT-licensed, issues/PRs open.", "url": "https://wpnews.pro/news/sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should", "canonical_source": "https://dev.to/divyansh0208/sahayak-an-ai-legal-assistant-that-says-i-dont-know-when-it-should-42l2", "published_at": "2026-09-27 19:54:40+00:00", "updated_at": "2026-09-27 20:31:02.180615+00:00", "lang": "en", "topics": ["ai-products", "large-language-models", "ai-tools", "natural-language-processing", "ai-safety"], "entities": ["Sahayak", "Hack2Skill", "PromptWars: Virtual", "FastAPI", "Groq", "ChromaDB", "sentence-transformers", "PyMuPDF"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should", "markdown": "https://wpnews.pro/news/sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should.md", "text": "https://wpnews.pro/news/sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should.txt", "jsonld": "https://wpnews.pro/news/sahayak-an-ai-legal-assistant-that-says-i-don-t-know-when-it-should.jsonld"}}