# Building efficient hybrid context query for LLM grounding: Simrat Hanspal AI Engineer · 2025-02-05 Simrat Hanspal from Hasura explains how to build efficient hybrid context queries for LLM grounding using Hasura's GraphQL API, demonstrated via an e-commerce product search use case. The talk covers three query types: semantic search (e.g., 'essential oils for relaxation'), structured search (e.g., 'products less than $500'), and hybrid queries combining both (e.g., 'essential oil diffusers between $500 to $1,000'). Hanspal shows how Hasura unifies relational (Postgres) and vector (Weaviate) databases into a single GraphQL API, auto-vectorizing records via events. A critical security demonstration highlights how role-based permissions (e.g., 'Product Search Bot' role with only select access) prevent malicious insert mutations like adding a fake product with ID 7001. The approach enables secure, dynamic data retrieval for Retrieval-Augmented Generation (RAG) pipelines without building separate APIs. ## Questions this episode answers ### How does Hasura enable efficient hybrid queries that combine semantic and structured search for LLM grounding? Simrat Hanspal explains that Hasura provides a unified GraphQL API across multiple data sources like relational databases and vector databases. This allows a single query to perform semantic similarity search on product descriptions in a vector DB while simultaneously applying structured filters, such as price range, on relational data. For example, a query for 'essential oil diffusers between $500-$1000' gets translated into a GraphQL query that handles both aspects seamlessly. [3:58](https://aie.addtry.com/624cf24f-3244-416e-9923-d71e14a09aef?t=238000) ### How can you prevent malicious data insertions when using natural language to query databases in GenAI applications? Simrat Hanspal demonstrates that in Hasura, you can create roles with restricted permissions, such as a 'Product Search Bot' role that only has select access. When a malicious natural language input attempts to generate an insert mutation, the role's lack of insert permission causes the query to fail, preventing unauthorized data changes. This addresses the primary enterprise concern of secure data retrieval in RAG applications. [8:22](https://aie.addtry.com/624cf24f-3244-416e-9923-d71e14a09aef?t=502000) ### How does Hasura automate the vectorization of data for vector databases? Simrat Hanspal describes using Hasura's event triggers to automatically vectorize records. In her demo, when a new record is inserted into a Postgres table, an event triggers the generation of its vector embedding, which is then stored in the vector database (Weaviate). This eliminates manual embedding and keeps the vector index synchronized with the source data. [4:55](https://aie.addtry.com/624cf24f-3244-416e-9923-d71e14a09aef?t=295000) ## Key moments - **[0:00] Intro** - **[0:59] RAG Overview** - [0:59] "Large language models are great, but they're frozen in time, and they cannot solve tasks on data they have not seen before." - **[1:45] Paradigm Shift** - **[2:56] Hasura Solution** - [2:56] Hasura's GraphQL APIs provide a unified, dynamic, secure data API for multiple data sources in no time. - [3:15] Product search queries can be semantic (vector DB), structured (relational filters), or hybrid. - **[3:58] Connecting Sources** - **[5:35] Streamlit App** - **[6:14] Semantic Query** - **[7:01] Structured Query** - **[7:47] Hybrid Query** - [7:47] A hybrid query for 'essential oil diffusers in the price range of $500 to $1,000' returned both semantic and structured results. - **[8:22] Malicious Query** - [9:11] A malicious insert mutation added a product to the database via Hasura API, exposing insecure default permissions. - **[9:39] Permission Fix** - [10:49] Setting a role with only select permission blocked the malicious insert mutation on Hasura. - **[11:05] Recap** ## Speakers - **Simrat Hanspal** (guest) ## Topics RAG & Retrieval ## Mentioned OpenAI (company), Hasura (product), Postgres (product), Streamlit (product), Weaviate (product) ## Transcript ### Intro **Simrat Hanspal** [0:18] Hey, hey, hey—how's everyone? This is Simrat Hanspal, Technical Evangelist at Hasura, and today I'm going to talk to you about building efficient hybrid drag queries. Let us understand this with the use case of product search in e-commerce domain. Present-day product search is mostly keyword-based; keywords are not great at capturing the complete intent of the user's search query, so you want to move to using natural language. But product search can be either contextual—where you're looking for, where you're searching for a product based on the descriptive nature—or it can be completely structured, where you're querying based on the structured fields, or it can be both. Large language models are great, but they're frozen in time, and they cannot solve tasks on data they have not seen before. One of the ways to expose the unseen data to large language model is by providing context to the question alongside the question. ### RAG Overview **Simrat Hanspal** [1:13] This helps the large language model generate more accurate and grounded answers. This powerful technique is called Retrieval-Augmented Generation, or RAG in short. So you see, we need to build a RAG pipeline for our product search use case. We also need to make sure that our RAG pipeline is production-ready and will not leak any sensitive data, even if prompted. This security concern has been one of the primary concerns of enterprises when building GenAI applications. ### Paradigm Shift **Simrat Hanspal** [1:45] Data-driven applications have been around for a while. Now, why are we talking about secure data retrieval all over again for GenAI applications? Well, this is because we are seeing a paradigm shift in application development. With data-driven applications, data is mostly constant, and it is the application or the software that evolves for any different or new functionality. For example, product search on current e-commerce websites would pick constant data fields; only the records or the results would change. While in context-driven or RAG application, the data is no longer a constant data packet, and it needs to adapt to the dynamic needs of the user's natural language query. With natural language query, there are no structural limitations, and it gives a scope for malicious attack. Good news: Hasura enables you to build secure data API over your multiple different data sources in no time. Hasura APIs are GraphQL APIs, and hence their dynamic in nature. So you get unified, dynamic, secure data API in no time, just what we needed. So let's get started with building a RAG pipeline for our product search use case. Let us again look at what are the different queries that we can expect for our RAG applications. ### Hasura Solution **Simrat Hanspal** [3:15] We can have semantic search, where we're searching based on semantic similarity with product description from product vector db. We can also have structured search, where we are searching based on structured fields in the relation database, like for example, price and category in Postgres. And this requires converting the natural language query into a structured query like SQL or GraphQL. Then we can also have hybrid queries. These searches have the elements of both semantic and structured queries. With Hasura, we don't need to build separate data APIs for each of them; we can build a unified data API for all three of them. ### Connecting Sources **Simrat Hanspal** [3:58] So let's get started. We start by connecting our multiple different data sources with Hasura, and then we query it using a single GraphQL API. I've also built a streamlit application which takes in the user input, calls the large language model, generates a GraphQL API query, which then gets executed on Hasura. So let's head over to Hasura console to get a feel of what it looks like. To start, we'll go to the data tab to connect all of our different data sources. I'm not going to do that because I have my product Postgres table and product vector table already integrated. As I mentioned before, you can use Hasura to query both your relational and vector db and multiple data sources using a single GraphQL API. But for the sake of simplicity of this demo, I'm going to be using only the vector db. So I'm using Weaviate in this case, where I have my vectors, and I have also got my price and category structured fields here. One thing to note here is that I have used Hasura's event to auto-vectorize my records into my vector db, which means as and when a new record got inserted into my Postgres table, it got auto-vectorized and saved in my vector db. Amazing, I know. So let's go back to—let's go to our API tab. This is where you will—you can play around, execute different queries, and see the results. ### Streamlit App **Simrat Hanspal** [5:35] Nice. Now that we have gotten a fairly decent sense of what Hasura console is like, we can move to the streamlit app that I have created. As you can see, there are a few configurations on the left-hand side panel. So you have Hasura's endpoint and admin secret. This is required to connect with Hasura securely. And then I also have OpenAI's API key. This is required for the chat completion API that I'm using. So let's begin. Let's begin with querying the three different contexts that we were talking about that we want to fetch. ### Semantic Query **Simrat Hanspal** [6:14] So let's start with purely semantic one. Let's look at the different product descriptions that we have and pick something. Let us pick products on essential oils. So let me say, "Show me essential oils for relaxation." Great. So we've gotten the GraphQL query, which has identified essential oils for relaxation as the descriptive part of the query which we want to find in our vector db by doing a semantic search. And we can also see that we have gotten the results for this query. ### Structured Query **Simrat Hanspal** [7:01] Nice. Let's go over and execute a structured query. Price is a good field to execute a structured query. So let's say, "Show me all products less than price $500." Great. So it hasrightly identified that there is a price filter with the less than condition, and it shows you all the different products with price less than $500. Nice. Let's execute a hybrid query now. ### Hybrid Query **Simrat Hanspal** [7:47] Let's say, "Looking for essential oil diffusers in the price range of $500 to $1,000." Nice. So we got a GraphQL query where it identified "Amazing Essential Oil Diffuser" as the semantic search query, and then the price filter which is between $500 to $1,000, and we received our results. Nice. So far we have executed only the happy flows. We have not looked at any other query where of unhappy flows. But let's say I had an evil intent and I wanted to execute a malicious query, which is not the typical queries that we just looked at. So I have a malicious query. ### Malicious Query **Simrat Hanspal** [8:38] Let's execute this. So this one is requesting to insert a product of hair—hair oil product—with the name "Special Oil" and price of $10,000. Category is "Form." "Fantastic Hair Oil" is the description. And let's also add the project ID and say this is 7001. Okay, let's execute this. So as you can see, it has generated a GraphQL query of type "Insert Mutation." But what we see is that it has also inserted the query. So let's go back to our table and console and look for product ID equal to 7001. Let's just remove the quotes because this is an integer field. And there you go, we have the product which has gotten inserted into the database. This was not the intended behavior. This is not what should have happened. So let us quickly go back to our Hasura console again, and this time we are going to be defining a new role with very restricted permissions so that we only provide select permission and such that this does not happen again. ### Permission Fix **Simrat Hanspal** [10:06] So I'm going to create a new role. Let's call it "Product Search Bot," and I'm going to provide only search permission. Let's go without any checks. I'm going to keep it really simple. Let me allow all the product—all the columns—to be accessible for this role. That's about it. Nice. So the role has gotten inserted. Now let's query the same thing with a new role. So let's say "Product Search Bot," but this time let me just modify this query a little bit and say 7002. Okay, so let's execute this and see what happens. Nice. So we got the same "Insert Mutation" query to be generated, but this time there was an error executing this. Rightly so, because we have defined a role which does not have the permission for insert queries. Great. So this is all from me. Thank you, everyone. Thank you once again. So let us really quickly recap. In this demo we learned how we can use Hasura to build hybrid query context for your sophisticated RAG applications like product search. ### Recap **Simrat Hanspal** [11:21] If you like the demo or would like to use Hasura for your RAG application, please reach out to me. These are my contact details, and thank you so much. --- This library is powered by PodHood (https://podhood.com), the podcast website platform.