An AI assistant with company documents: what it solves and how to make it safe

The problem is usually finding, not generating

Many companies already have the answer, but it is spread across manuals, folders, emails and the memory of key people. An assistant can take a question, retrieve relevant fragments and write an answer. Its value depends on finding the right source, not on producing elegant text.

That is why the first deliverable is an inventory: current documents, owner, audience and date. Duplicated or contradictory files are resolved before connecting them. An assistant cannot govern knowledge the company has not decided is official.

How it works without “training it on everything”

A common architecture indexes documents and retrieves fragments related to the question. The model receives those fragments and writes within its limits. Documents can be updated without retraining the whole model. Even so, there are decisions about splitting, labels, search and relevance that must be tested.

The answer should show references or links and distinguish a quotation from interpretation. For critical questions it can be limited to excerpts and ask for confirmation. If it does not find enough evidence, it should say so and point to whom to escalate, not fill the gap with a plausible answer.

Permissions and attacks from documents

Not every user should query everything. Permissions are checked before retrieving content and not only in the interface. Also, a document can contain malicious instructions or text that tries to change the agent’s behaviour. Treat it as data, not as orders.

Apply least privilege, isolation by client or area, query logs and source review. Avoid indexing credentials, exported databases or personal files. If the assistant can execute actions, separate reading from writing and require confirmation for changes.

• Sources with an owner and validity date
• Permissions applied at retrieval
• Visible references
• A safe answer when there is no evidence
• Tests for leakage and malicious instructions

What to test before opening it to the team

Create easy, ambiguous, cross-cutting and unanswerable questions. Check that it finds the current version, does not mix areas and does not reveal restricted content. Include similar names, old policies and questions that need more than one source. Record retrieval accuracy separately from writing quality.

Start with a small group and a feedback button that captures the cause. A bad answer can come from a missing document, a permission, the search, an instruction or the wording. Classifying it lets you fix the right component and build trust with evidence.