RAG Agent issue -- grant_permissions.sh script calculates RAG_CORPUS id but never uses it

[jsteinberg-rbi]

grant_permissions.sh script calculates the RAG_CORPUS path presumably to give tightly scoped permissions to the iam role the script is creating, but then never actually uses RAG_CORPUS env var for anything (but some stdout notifications). I assume this is a bug? I haven't run the script yet, but I think if you scrutinize you'll see what I mean. I just did a text search for "RAG_CORPUS" and it's pretty obvious it never gets used or converted to anything else. Fwiw.

[onestardao]

Good spot — this looks like a classic case of ProblemMap → No.6: Silent Variable Sink / Execution Drift.

You’re right: calculating RAG_CORPUS without actually binding it to IAM or downstream usage creates a false sense of permission scoping. These logic drifts are especially hard to trace when they're silent (no error, just a no-op path).

We’ve cataloged and symbolically patched several similar cases across RAG agents. If you’re curious, I can share the map — MIT licensed, backed by real-world usage (even got a star from the Tesseract.js author).

Let me know if you want to dive in.

[ivanmkc]

I reviewed the code, seems like:

• grant_permissions.sh is used to grant the service account permission to use RAG_CORPUS
• It is referenced later in RAG/rag/agent.py, namely:

ask_vertex_retrieval = VertexAiRagRetrieval(
    name='retrieve_rag_documentation',
    description=(
        'Use this tool to retrieve documentation and reference materials for the question from the RAG corpus,'
    ),
    rag_resources=[
        rag.RagResource(
            # please fill in your own rag corpus
            # here is a sample rag corpus for testing purpose
            # e.g. projects/123/locations/us-central1/ragCorpora/456
            rag_corpus=os.environ.get("RAG_CORPUS")
        )
    ],
    similarity_top_k=10,
    vector_distance_threshold=0.6,
)

So I don't see an issue. Reopen if you still have questions.