Building an AI Knowledge Assistant for Your Business: Scope, Data and Evaluation

An internal knowledge assistant can help employees find and interpret approved business information. It might answer questions about procedures, product documentation or support material. Its value depends on whether the answer is useful, supported by the right source and available only to the person entitled to see it.

Adding a chat box to a document folder does not establish those properties. Before development, define the questions the assistant should handle, the decisions it should not make and the process for correcting its knowledge. A narrow, well-evaluated assistant is a more useful starting point than a promise that it can answer anything about the business.

Choose a bounded use case

Begin with a recurring information problem. For example, support staff may spend time locating the current installation procedure for a product. The assistant can help retrieve the relevant section and explain it, while a human remains responsible for the customer's case.

Separate information retrieval from taking action. Answering “What is our refund process?” is different from issuing a refund. The second task introduces permissions, transaction limits, confirmation and recovery requirements. Do not bundle those actions into the first release merely because the assistant can generate a plausible instruction.

Write an explicit boundary: supported topics, intended users, excluded decisions and the escalation route. The boundary should appear in the experience where it helps users judge an answer, rather than being hidden in technical documentation.

Prepare the knowledge sources

Inventory documents and identify the owner of each collection. Remove obsolete duplicates, label versions and determine which source wins when two documents disagree. If the business itself cannot identify the current procedure, an assistant cannot reliably resolve that conflict by sounding confident.

Check the actual files. Scanned PDFs, tables, slide decks and images may need different extraction methods. A document that looks readable to a person may contain little usable text. Test extraction on representative examples before estimating a large ingestion project.

Keep a link between extracted information and its original source. Users should be able to open the document or section behind an answer. That reference is useful both for trust and for diagnosing why an answer was wrong.

Preserve document access permissions

An assistant must not become a shortcut around existing access controls. A user who cannot access a confidential document should not receive its contents through a generated answer, a citation title or a search result excerpt.

Define how user identity and document permissions reach the retrieval process. Test with users from different departments and organisations. Include questions that tempt the assistant to combine public material with restricted information.

Permissions also change. Decide how quickly revoked access and removed documents are reflected in the assistant's knowledge. A copy of an old document in a search index can remain sensitive even after the original file is deleted.

Require evidence and useful uncertainty

For questions grounded in company material, ask the product to show its supporting sources and distinguish documented facts from a proposed interpretation. If the knowledge base does not contain an answer, the assistant should say what is missing and suggest a useful next step.

Do not evaluate quality only by whether the answer sounds fluent. A concise answer with a relevant source can be more valuable than a polished explanation built around the wrong policy version. The interface should make it easy to inspect the evidence rather than hiding citations behind several interactions.

For high-impact decisions, define a human review step. The assistant can help locate information and prepare a draft without being authorised to make the final business decision.

Treat untrusted content as data

Documents and user messages may contain instructions that should not control the assistant's behaviour or tool access. The design needs to separate the application's rules from the content it retrieves. This becomes particularly important when material comes from external sources.

Use restricted tools and explicit permissions if the assistant can perform actions. A document saying “send this file elsewhere” should not grant that ability. Keep consequential actions behind a defined confirmation and authorization process appropriate to the business.

The OWASP generative AI security project provides a primary reference for risks such as prompt injection and unsafe handling of model output. Use it to inform a threat review, then convert the relevant risks into tests for your actual use case.

Build an evaluation set before the pilot

Collect realistic questions from intended users and write down what a satisfactory answer requires. Include straightforward questions, ambiguous requests, outdated-document traps, missing answers and attempts to obtain restricted information.

Evaluate source relevance, factual support, usefulness and appropriate escalation. Keep the test set under review as the knowledge base changes. A demonstration using five carefully chosen prompts does not show how the system performs on ordinary staff questions.

Have subject-matter owners review a representative sample of responses. Record the reason for each failure so the team can distinguish poor source material, retrieval problems, permission errors and unsupported generation.

Plan feedback and content maintenance

Let users report an incorrect or unhelpful answer with enough context for investigation. Route policy errors to the content owner and product errors to the delivery team. A feedback button without an owner becomes a collection of unresolved complaints.

Define how new documents are approved, indexed and retired. Include the time needed for subject-matter review in the operating model. An assistant built around procedures that nobody maintains will gradually become less dependable.

Measure whether it helps users complete the intended task. Useful indicators might include time to find an approved procedure, successful source discovery and the proportion of questions correctly escalated. Avoid claiming business savings before measuring a comparable baseline.

Estimate the full operating scope

Development may include document ingestion, identity integration, retrieval, conversation design, evaluation and administration. Operating cost can include model usage, search infrastructure, storage, monitoring and content maintenance. Estimate using realistic document sizes, question volumes and retention requirements.

Start with one knowledge collection and a controlled user group. Our pilot planning Insight can help define the evaluation and exit criteria. Explore AI development and AI software examples, then discuss a knowledge assistant around a specific information problem.