Loading...
Loading...
Stop hand-waving about access control. Build a chatbot where finance queries cannot retrieve engineering docs, where sessions expire, where rate limits hold under load, and where admins manage users and documents from the same UI.
Message a mentor about fit, prerequisites, or where to start. Replies come on WhatsApp, usually within a day.
Engineers are learning here from
Ship a role-gated RAG chatbot where finance, engineering, and admin users see only their own documents. Session auth, sliding-window rate limits, ChromaDB retrieval per role, OpenRouter generation, and a Gradio admin panel.
Role-gated RAG chatbot: per-role document walls, session auth, rate limits, and an admin panel.
What you'll ship
What you'll learn
Curriculum
Why RBAC + RAG
The leak problem, where the access boundary really lives, and the pipeline you will build
Project tour and setup
Clone the repo, tour the files, and take the first role-gated query end to end
Authentication foundations
PBKDF2, per-user salts, session tokens with auto-renewing expiry, and account lockout
Role-gated vectors
One ChromaDB collection per role and local sentence-transformers embeddings
RAG chain with role filter
The retrieval-to-response loop with a role-aware prompt and OpenRouter generation
Rate limiting
A sliding-window limiter per username that holds under concurrent load
The admin panel
Create users, assign roles, upload documents — without a redeploy
Ship it and extend
Capstone checkpoint, the four upgrades that take this to production, and where to go next
Who it's for
who need per-team document walls before legal signs off on the rollout
looking for the first project that feels like enterprise software instead of a notebook
comfortable with auth and rate limits but unsure how retrieval itself enforces access
FAQ
No. The embeddings run locally through sentence-transformers and the chat model runs through OpenRouter. A single OpenRouter key covers the whole course, and free-tier models work for every lesson.
It is closer to production than a notebook but not a drop-in enterprise system. The JSON-file user store, opaque session tokens, and in-memory rate limiter are pedagogical choices. Module 8 walks through the upgrades: Postgres, JWT, audit logs, and per-role limits.
Gradio gives us a working three-tab UI in under 200 lines so you can focus on the RBAC and retrieval pieces, not on building login forms. One of the stretch challenges migrates the same backend modules to FastAPI if you prefer that shape.
Yes. The course uses uv, a pyproject.toml, and a Makefile. `make dev` runs locally without Docker. The Docker setup is there for anyone who wants to demo the app to a teammate in one command.
Pricing
One subscription unlocks every paid course and workshop replay. Pick yearly or monthly.
Unlock with Pro
You save 47% with regional pricing
Billed annually. Cancel anytime.
Still deciding? Ask Param a question
Role-gated RAG chatbot: per-role document walls, session auth, rate limits, and an admin panel.
Build an RBAC-gated RAG chatbot
From $16/mo with Pro