How Akhil Koduri Is Reframing Retrieval-Augmented Generation for High-Stakes, Regulated Environments
Presented at IEEE COMPSAC 2026. The research summarized here was presented at the 50th IEEE Computers, Software, and Applications Conference (COMPSAC 2026), the IEEE Computer Society’s flagship conference, held 7–10 July 2026 in Madrid, Spain. Fittingly, the 2026 edition carried the theme “Agentic AI: Migrating from Reactive Models to Proactive Systems” — the exact shift this work addresses in the context of regulated, trust-critical AI.
Retrieval-augmented generation (RAG) has quickly become the default way enterprises ground large language models in their own knowledge. But in finance, healthcare, and governance where a wrong answer can carry legal weight, grounding alone has proven insufficient. The retrieval is opaque, the reasoning is probabilistic, and the provenance is thin. For a regulator, that combination is disqualifying no matter how accurate the output looks.
Akhil Koduri, a Senior Grade IEEE member, an independent researcher and PhD student focusing on Artificial Intelligence, is among a growing group of practitioners arguing that the problem isn’t retrieval quality, it’s that these systems were never designed to reason about trust itself. His recent work proposes a trust-aware agentic architecture that treats trust not as an implicit byproduct of similarity scores, but as an explicit, governing decision variable.
The Gap Between Accuracy and Auditability
In most RAG pipelines, “relevance” is inferred from vector similarity, and the system assumes that a semantically close document is a trustworthy one. In regulated settings, that assumption breaks down.
“In regulated AI, trust extends beyond accuracy. A similarity score can tell you a document is related. It cannot tell you the reasoning is traceable, the source is verifiable, or the decision is defensible to an auditor.”
— Akhil Koduri
Koduri identifies three structural deficiencies that make conventional RAG a poor fit for regulated deployment: hallucination persists even when retrieval succeeds, pipelines offer little visibility into why a given document shaped an output, and the systems lack the deterministic constraint enforcement and verifiable data lineage that regulators require. The result is an architecture that can be right and still be non-compliant.
A Hybrid, Trust-Governed Architecture
Koduri’s answer is a layered system that pairs semantic retrieval with structured reasoning, coordinated by an agent that enforces trust before anything reaches the user. It has four components:
- LLM Generation Layer — natural language understanding and generation, constrained by upstream retrieval and trust signals rather than operating freely.
- Vector Retrieval Layer — dense-embedding semantic access to unstructured documents, the familiar strength of conventional RAG.
- Knowledge Graph Layer — structured domain knowledge, regulatory rules, entity relationships, and provenance metadata that support deterministic reasoning through explicit graph traversal.
- Trust-Aware Agent Orchestrator — the control plane that selects retrieval strategies, validates evidence across both layers, enforces compliance constraints, and logs every reasoning step to an audit module.
The defining move is that the knowledge graph is not an auxiliary lookup bolted onto retrieval. It is a compliance substrate—a place where regulatory rules live as traversable, inspectable paths.
Figure 1. The trust-aware agent aggregates evidence from both retrieval modalities, computes a composite trust score, and gates generation against the threshold τ.
Making Trust Quantifiable
Rather than leave “trust” as a vague quality, Koduri’s framework decomposes it into three measurable signals, each normalized to the interval [0, 1]:
- Source Provenance (Ps) — the credibility and traceability of a retrieved document or graph node, derived from metadata such as source authority, recency, and citation depth.
- Graph Path Confidence (Cg) — the logical consistency and rule-satisfaction of the reasoning path connecting a query to the relevant regulatory rule nodes.
- Retrieval Consistency (Rc) — the degree of agreement between what vector retrieval surfaced and what the knowledge graph independently supports.
These combine into a single composite trust score:
T = αPs + βCg + γRc
where α + β + γ = 1 and T ∈ [0, 1]
The weights α, β, and γ are tuned to a domain’s regulatory priorities—an anti-money-laundering context, for instance, might raise β to privilege deterministic graph reasoning. The agent then compares the composite score against a domain-configured threshold τ and acts on the result:
- T ≥ τ → proceed with generation;
- T < τ → halt, request additional evidence, or defer to deterministic knowledge-graph reasoning.
“The agent’s job is to prevent the model from acting on high-similarity but low-trust evidence. When the signals disagree, it doesn’t guess—it halts.”
— Akhil Koduri
What It Looks Like in Practice
Consider an AML query: “Is Transaction T-17 compliant with AML regulation?” Vector retrieval surfaces relevant guidelines and risk policies; the knowledge graph traverses from a regulation to a specific clause and lands on a high-risk flag. Suppose the agent computes Ps = 0.91, Cg = 0.88, and Rc = 0.86, for a composite score of T = 0.88 against an illustrative threshold of τ = 0.85.
Even though the score clears the threshold, the deterministic graph path activates the high-risk flag so the output is routed for audit rather than auto-approved. That inversion, where a deterministic rule takes precedence over a passing probabilistic score, is the point. It moves AI compliance support from probabilistic adequacy to structured defensibility: justifying not just what answer was produced, but why it was permissible. (The values here are illustrative, chosen to demonstrate the decision logic rather than to report experimental results.)
Aligning With How Regulated Sectors Actually Work
The architecture maps onto real operational pressures:
- Financial Services / AML — Standard LLMs flag transactions as statistical anomalies without a defensible rationale, a problem for regulators who require clear evidence chains for Suspicious Activity Reports. Treating rulebooks as a knowledge graph lets the system link a compliance rule deterministically to the entities in question.
- Healthcare / Clinical Decision Support — By rooting the trust threshold (T ≥ τ) in a graph of approved clinical protocols, the agent can act as a safety interlock, halting recommendations that lack a valid path in the protocol graph. If retrieval consistency (Rc) drops due to vector–graph disagreement, generation stops.
- Operational Model Shift — Quantifying trust (T) opens the door to a Human-on-the-Loop posture: high-trust outputs flow through automatically while borderline cases are escalated, backed by a structured audit trail of which rules were traversed and why.
What Comes Next
It is a conceptual and architectural contribution—a design, assessed by structural reasoning against the properties regulators actually care about: traceability, determinism, and auditability. It deliberately makes no empirical performance claims; there is no benchmark here reporting a percentage-point drop in hallucinations. Being clear about that scope is part of the argument, not a hedge around it, the point is to show how trust can be made an explicit, enforceable property, and to give practitioners a structure they can build and test against.
That scoping leaves a concrete research agenda. The trust weights (α, β, γ) and the threshold τ are configurable by design, but deriving them in a principled, domain-specific way and treating τ as a graduated response rather than a binary cutoff is open work. So is live validation: benchmarking on real regulatory datasets to quantify latency, operational overhead, and calibration under production conditions. And because the deterministic guarantees rest on the knowledge graph, the approach is only as reliable as that graph is complete and well maintained – a nontrivial, ongoing cost in fast-moving regulatory domains. None of these are incidental caveats; they are the roadmap from a validated design to a deployed system.
“The contribution here is structural—a way to make trust explicit, inspectable, and enforceable. Calibrating and benchmarking those trust parameters on real regulatory data is the next milestone, and we treat it as core work, not an afterthought.”
— Akhil Koduri
Why This Matters Now
As agentic AI moves into decision-support roles in regulated industries, the bottleneck is shifting from capability to accountability. Koduri’s contribution reflects a broader change in thinking: trust should be an engineered, first-class property of the system, not an assumption inherited from retrieval relevance. Frameworks that make trust explicit, quantifiable, and auditable are likely to shape how compliant AI is built—and how quickly institutions feel safe adopting it.
The question is no longer whether regulated sectors will use RAG, but whether they can prove why each answer was allowed. Architectures that treat trust as a governing variable offer one credible path to that proof.
About the Author
Akhil Koduri is a Senior IEEE Member, an independent researcher and PhD student in Information Technology (Artificial Intelligence) at the University of the Cumberlands. His research focuses on trustworthy, auditable, and compliance-aligned AI architectures for regulated domains such as finance, healthcare, and governance, with emphasis on hybrid retrieval, knowledge-graph reasoning, and agentic system design. This work was presented at IEEE COMPSAC 2026 in Madrid, Spain.
