They admit a raw LLM would be dangerous and then proceed to use RAG... How is this any better? You cannot allow an LLM to generate the final outbound message if you are liable for what it says.

LLM to understand the question? Yes. Generate SQL maybe with Embeddings to look up answers? Yes. Generate the final response? No.