A hospital wants to build an internal assistant that answers clinician questions using a large, frequently updated set of internal treatment protocols. The protocols contain sensitive patient-adjacent data that must never be embedded permanently into a model's weights, and new protocol revisions are published weekly. The team also wants answers to cite the specific protocol document they came from. Which approach best meets these requirements?