An AI internal knowledge base that answers from the right sources

Start with one operating area: purchasing approvals, equipment requests, customer handoffs, or the steps for closing a project. Collect actual questions from the people doing the work, then ask the process owner which document should answer each one. The useful outcome is a correct next step with its source, not a conversational wrapper around every file the company has ever stored.

Retrieval-augmented generation, or RAG, combines retrieved content with a language model’s answer. Microsoft’s overview describes grounding responses in proprietary content and identifies retrieval relevance, access control, and governance as practical challenges. Retrieval provides evidence to inspect; it does not turn an incomplete handbook into a complete or automatically correct answer.^[1]

For each document, record its owner, status, version, effective date, applicable location or team, and access group. Separate approved procedures from meeting notes, drafts, and archived copies. A recent modification timestamp may reflect a formatting change, not a newly approved policy. Retrieval date tells you when a document was fetched; it does not prove the content is current.

Avoid feeding entire shared drives into the first pilot. Start with the smallest useful collection and fix missing ownership or duplicate policies before expanding. The ICO’s data-minimisation guidance supports keeping personal data relevant and limited to the purpose. Remove unnecessary employee details and customer information from the corpus, and assess applicable privacy obligations for your organization.^[3]

The system should determine the requester’s identity and allowed groups, then restrict retrieval before passing document passages to the model. “Do not reveal confidential material” is an instruction, not an access control. Microsoft’s document-level access documentation describes query filtering and permission-aware approaches for excluding unauthorized documents. The specific implementation depends on your search and identity systems; some documented provider features are previews, so check their production suitability.^[2]

Test indirect disclosure too: search previews, document titles, summaries, conversation history, and shared answer links can expose information even when the full file is blocked. Cached answers must not outlive the permission that made them accessible. If access is revoked, prevent subsequent retrieval and check how saved answers, exports, and shared records are handled. Permission to read a source is not permission to distribute its content to everyone in a workspace.

Ask for the direct answer first, then the steps, relevant limits, and sources. Each material policy statement should map to an authorized passage, not merely a relevant-looking file title. Include a section or paragraph location, version, effective date when available, and retrieval date. Mark unavailable dates as unknown. A citation should let the employee or reviewer locate the actual support for the claim.

Keep unanswered parts explicit. “I found the request procedure but not the approval limit for your region” is useful when followed by the responsible owner. Distinguish what a document states from an inference about the user’s eligibility. Do not produce a numerical confidence score unless it has been meaningfully calibrated; a list of evidence gaps is usually more actionable.

All organizations, policies, and amounts in this example are fictional. An employee in Berlin asks whether a €650 monitor can be reimbursed. The authorized packet contains an approved global policy v2 effective September 1, 2026 with a US-dollar limit, an approved EU addendum effective September 15 setting a €500 cap for eligible equipment, and an October 1 finance draft proposing €800. The retrieval date is October 7. The draft is not approved.

An initial answer says, “Yes, the newest policy allows €800.” The reviewer rejects it: recency does not establish approval, the regional addendum matters, and the employee’s eligibility and equipment category have not been verified. The corrected answer uses the approved regional cap without converting the global dollar limit or claiming purchase approval. The difference between €650 and €500 is €150; that arithmetic does not settle an exception request.

Document owners should define which sources govern which questions: for example, an approved regional addendum may override a general procedure within its stated scope. The AI should apply that rule only when the source actually establishes it. If two approved documents conflict without a clear precedence rule, show the conflicting passages to an authorized reviewer and ask the owner to resolve them. Do not silently choose whichever text is easier to summarize.

Retrieved documents may also contain malicious instructions, such as a hidden request to reveal other files. OWASP explains indirect prompt injection through external content and warns that RAG does not fully mitigate it. Treat passages as untrusted evidence, restrict available actions, and keep access controls outside the model. An abstention should name the missing information or safe escalation route without reproducing harmful instructions or unauthorized content.^[4]

Build a test set from real recurring questions, rewritten without unnecessary personal data. A source owner should record the expected answer, acceptable evidence, and conditions requiring abstention. Include the everyday short versions people actually type, such as “new laptop?” or “who approves this?”, as well as clear questions. The system should ask a focused clarification when location, role, or date changes the answer.

Run the same relevant questions as an authorized employee, a different-team employee, and a user whose access was removed. Review answer text, previews, titles, citations, and saved output visibility. Keep access failures distinct from ordinary wrong answers: a high average answer score cannot compensate for exposing one restricted personnel document. Re-run this set after changing sources, retrieval, identity integration, or model configuration.

Assign a named owner for each topic and a person responsible for the retrieval service. The topic owner approves content and resolves contradictions; the technical owner maintains ingestion, access propagation, and failure visibility. Give every source a review date and a way for employees to report an incorrect or obsolete answer. When a source is superseded, update its status and check that retrieval and saved answers no longer present it as current.

Measure supported-answer accuracy, correct abstentions, successful source opening, and the time employees spend verifying or escalating. Use a fixed reviewed set alongside feedback from live use. For a fictional test of 40 answerable questions, 34 fully supported answers gives 85%; the remaining six still need inspection. Report permission tests and critical failures separately. This illustrative fraction is not a launch target or evidence of business savings.

Use Kona Workspace with approved files or connected context you are authorized to access. Begin by asking for a source register, a list of unresolved ownership or version questions, and answers to a small employee-question set. Check that each answer’s cited source is actually available. This is a reviewable knowledge-work exercise; it does not imply that uploading a mixed-permission folder creates a production permission-aware search service.

Before sharing results, confirm that each recipient may see the underlying material. Keep restricted topics in appropriately restricted workspaces and use separate authorized packets when necessary. A production knowledge integration needs verified identity, document-level retrieval controls, access-change handling, and safe sharing behavior. Add more topics only after those controls and the answer-quality checks work for the initial collection.