> ## Documentation Index
> Fetch the complete documentation index at: https://developer.box.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Build RAG over enterprise documents stored in Box
> Build retrieval-augmented generation (RAG) over documents in Box. Start with Box Hubs and Box AI Ask for permission-aware answers. Export to Pinecone or Weaviate, or use LangChain, when you need a custom retrieval stack.
export const RelatedLinks = ({title, items = []}) => {
const getBadgeClass = badge => {
if (!badge) return "badge-default";
const badgeType = badge.toLowerCase().replace(/\s+/g, "-");
return `badge-${badge === "ガイド" ? "guide" : badgeType}`;
};
if (!items || items.length === 0) {
return null;
}
return
;
};
export const Link = ({href, children, className, ...props}) => {
const localizedHref = localizeLink(href);
return
{children}
;
};
Start with **Box-managed retrieval**: add files to a Box Hub and call Box AI Ask. Box retrieves content, grounds the answer, and checks the requesting user's permissions. You do not operate your own embedding pipeline or vector database for that path.
Build your own pipeline (chunk, embed, store, generate) only when Box-managed retrieval does not cover your use case.
A free developer account gives you access to the Box AI API, Hubs, and the content APIs you need to test both paths.
## Which approach to use
| If you need… | Do this |
| ---------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------- |
| Answers on documents already in Box, with citations and the same permissions as the web app | Hub + `POST /2.0/ai/ask` |
| A governed knowledge base (staging, approval, then query) | Access-controlled AI knowledge base |
| An index that mixes Box with other sources, a custom embedding model, or custom chunking and ranking | Export Box content to LangChain, LlamaIndex, Pinecone, or Weaviate. Enforce permissions in your retrieval layer |
## Box-managed retrieval
Box AI Ask with a hub as the item:
* Indexes hub content. No vector store to host.
* Returns answers only from files the calling user or app can access.
* Includes citations to source files.
* Stays current as files and hub items change. No re-index job to run.
For a full walkthrough, see Access-controlled AI knowledge base. For working apps, see the RFP answer bank and company brain tutorials.
## Your own RAG pipeline
Export from Box when you need:
* A retrieval engine or embedding model Box AI does not offer.
* A single index that combines Box documents with other sources.
* Custom chunking, ranking, or evaluation.
* Model hosting you control.
Typical flow:
1. Choose folders or files the application can read. Do not index the enterprise root.
2. Pull text with Box representations or your own parsers. See the Pinecone and Weaviate tutorials.
3. Chunk text, generate embeddings, and store vectors with Box file IDs and permission metadata.
4. At query time, embed the question, search the index, then drop chunks the current user cannot access in Box.
5. Send the question plus allowed chunks to an LLM. Cite Box file IDs in the answer.
Framework loaders: LangChain, LangChain.js, and LlamaIndex.
## Keep an exported index permission-aware
Box does not enforce permissions inside Pinecone, Weaviate, or your LLM prompt. After you copy text out of Box, your service is responsible for access control.
At a minimum:
* Store the Box file ID and version ID on every vector.
* Before returning results, check the querying user's Box permissions. Drop chunks from files the user cannot open.
* Refresh the index when files, collaborations, or sharing change. Use events or webhooks, not a one-time crawl.
* Re-check access at query time even if you cached permissions at index time. Sharing changes faster than most batch jobs.
If your main requirement is permission-aware answers and the content is already in Box, use hubs and Ask instead. See Box-managed retrieval or your own RAG pipeline.