# Company knowledge should be useful to the people allowed to use it.

> An internal knowledge assistant should not create a second truth. It should help employees find relevant, current information with the same permission boundaries that govern the underlying source systems.

Canonical URL: https://marmation.com/solutions/enterprise-knowledge-systems/

## The decision

Can this employee verify this answer?

Answer only from current, authorized evidence, preserve its lineage and expose a no-answer state when those conditions are not met.

## The situation behind the request

Teams work across SharePoint, policy manuals, product documentation, tickets and databases. Search results are hard to reconcile because documents have different owners, versions and expiration patterns. People may spend longer checking an answer than finding the information themselves.

## Where the obvious solution falls short

A vector index on its own does not solve versioning, entitlement, source attribution or trust. More retrieval often makes an answer more confusing. The hardest design decision is what to do when trusted sources disagree or an employee asks a question their role should not answer.

## How we would approach the work

We map authoritative sources, document freshness, identity, indexing cadence and expected user questions. We benchmark retrieval methods against a real evaluation set and design an interface that makes supporting evidence visible. The assistant needs an honest no-answer state.

## What the engagement may include

- Connectors and indexing plan with source ownership and refresh strategy.
- Document and tenant permission checks at retrieval and application layers.
- Source-grounded answer interface, confidence/limitations and fallback workflows.
- Search/retrieval evaluation, error monitoring and operational runbook.

## The choices worth making explicitly

Native Copilot or enterprise search may be sufficient. Custom engineering is justified by unusual permission models, specialized research workflows, action integration, data types or user experience. Do not rebuild commodity search simply because it is possible.

## What we would test before calling it ready

Test confidential material against a lower-privileged account, revoked access, duplicate documents, stale policies, contradictory sources and questions with no answer. Source citations should point to information the requesting user is actually authorized to open.

## A sensible first step

Start with one knowledge domain, a realistic set of questions and two permission groups. If retrieval cannot be trusted there, scaling it across the company will not solve the problem.

## Related reading

- [Retrieval cannot be allowed to widen a user's permissions.](https://marmation.com/expertise/permission-aware-rag/)
- [Private AI is not one architecture.](https://marmation.com/solutions/private-enterprise-ai/)
- [Make AI work with the systems your business already runs.](https://marmation.com/solutions/enterprise-ai-systems/)