Three media types, one citation experience
A text citation is a snippet and a page reference. An audio citation is a moment in a waveform. A video citation is a time range inside a file that may be hours long.
FIELD NOTES / ENTERPRISE KNOWLEDGE
The answer is in the recording.
At minute forty-seven.
Compass gives employees one governed interface for asking questions across approved company content — documents, recordings and training videos — and opens the cited source at the exact moment the answer came from.
ENTERPRISE AI CASE STUDY
Compass
Managed RAG on Amazon Q Business.
Timestamp-aware citations.
Compass / Grounded answer with citationsACTUAL PRODUCT INTERFACE
THE VERIFICATION LOOPOne answer. Three checkable sources.
A document page, an audio moment and a video segment — cited side by side under the same answer.
Follow the citation ↗AskRetrieveGroundCiteVerify
DOMAIN
Enterprise knowledge management
WHAT WE BUILT
Custom chat experience on managed RAG
OUR ROLE
Architecture to identity & DevOps
01 / THE VERIFICATION PROBLEM
An answer you cannot verify
is an answer you cannot act on.
Internal knowledge lives in three places at once: document repositories, recorded meetings, and training video libraries. Finding one specific fact means opening folders, skimming PDFs, and scrubbing through recordings by hand.
The problem is worst for multimedia. A policy detail explained at minute 47 of an enablement call is effectively unfindable. Employees either re-watch the recording, ask a colleague, or act on memory.
Every architectural decision in Compass — source attribution mapping, access revalidation on citation click, timestamp seeking — exists to make answers checkable.
A parallel index would drift
Running every video through a custom transcription pipeline doubles processing cost and creates a second source of truth that drifts from the first.
The browser cannot be trusted with identity
A custom application must not hand the browser AWS credentials or believe what it claims about who the user is — document permissions depend on it.
02 / INSIDE THE PRODUCT
Ask in the interface.
Verify in the source.
Four views of the delivered platform.
Each shows another part of how an answer becomes checkable.
One interface over every approved format.
PDFs, Office documents, text files, scanned content, audio and video all flow through one S3 bucket and one connector — with suggested starting questions for every answer.
THE VERIFICATION LOOP
Sync content→Authenticate→Ask→Stream answer→Attach citations→Open the source
03 / IDENTITY AND GROUNDING
The browser can ask.
It can never authorize.
Every call — chat, history, deletion, citation access — runs under the verified employee's identity so Amazon Q Business can enforce document ACLs per user. There is no code path where a browser-supplied user ID becomes authorization evidence.
A citation link is never a bearer of authority: opening one revalidates the session and source access before any media URL is returned.
Look under the hood ↘01
Verify the identity at connect
The connection Lambda validates the session token and derives the immutable user and group context.
Page and snippet
Document citations show the source title, a quoted snippet and a page reference, backed by a protected link.
Start and end time
Video and audio citations carry the returned start and end timestamps, so the player opens at the cited moment.
02
Retrieve under that identity
Amazon Q Business applies the user's identity, group membership and indexed source ACLs to every retrieval.
03
Revalidate before opening a source
The citation resolver re-checks session and source access, then returns a short-lived URL with start and end seconds.
04 / THE TECHNOLOGY & THE REASON
Managed where it should be.
Custom where it matters.
Compass deliberately does not build an application-managed vector database, a duplicate transcription pipeline, or a parallel conversation store. Amazon Q Business remains the system of record; Compass adds the experience, the transport, the identity boundary and the citation navigation.
Q
KNOWLEDGE & RETRIEVAL
Amazon Q Business
System of record for knowledge, conversations, messages and source attributions, with native multimedia extraction.
Why not our own vector store?
No second index to operate, and no transcription pipeline that can drift out of sync with the first.
CONTENT LAYER
Amazon S3
A private, KMS-encrypted, versioned bucket holds all approved content, crawled on an incremental synchronization schedule.
Why incremental?
Multimedia takes longer to process than text; re-crawling everything on every run would be slow and expensive.
RUNTIME
AWS Lambda
Four single-purpose functions behind the WebSocket API: connection and auth, streaming chat, conversations, and the citation resolver.
Why four, not one?
Least-privilege permissions per function — clearer security boundaries and smaller failure domains than one monolithic backend.
TRANSPORT
API Gateway WebSocket
Carries all chat, conversation and citation actions, relaying ordered response deltas as the answer is generated.
Why a streaming transport?
Employees read the answer while it is being written, with a stop control available mid-stream.
IAM
IDENTITY
IAM Identity Center
Employees authenticate through the organization's identity provider; the trusted backend establishes identity-aware credentials per user.
Why a trusted backend?
The browser never receives AWS credentials, and its own claims are never treated as authorization.
DDB
TRANSIENT STATE
DynamoDB
Holds short-lived WebSocket connection context only, expiring on its own through TTL.
Why so little state?
Q Business already stores conversations and messages, so a parallel conversation store would be a second thing to keep correct.
The architecture and product narrative reproduce the supplied project documentation. Interface values are product screen data.
Explore the documented platform stack
- Knowledge & retrieval
- Amazon Q Business · native multimedia extraction · time-stamped indexing
- Content & storage
- Amazon S3 · KMS encryption · versioning · incremental connector sync
- Runtime
- AWS Lambda (Node.js & Python) · Amazon API Gateway WebSocket APIs
- Identity & access
- IAM Identity Center · server-side token validation · identity-aware SigV4
- Experience
- Single-page application · AWS Amplify Hosting
- Operations
- CloudWatch logs, metrics & alarms · X-Ray tracing · CloudTrail audit history
Technology names identify the documented implementation, not partnerships or endorsements.
A CONVERSATION ABOUT YOUR KNOWLEDGE WORKFLOW
Where does your team
lose the answer?
Bring one internal knowledge workflow — documents, recordings, training content, or all three. In 20 minutes, we will map where retrieval, permissions and verification have to meet.
20 minutes · Your content, permissions and constraints