Source: [Original HTML page](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/)

Language: English

ASSESSMENT AND IMPLEMENTATION

# Find answers in your company’s approved knowledge.

The procedure may already exist, yet colleagues still have to ask around to find it. Stolen Orbit proposes internal assistants that retrieve approved documents and prepare answers with inspectable references. The starting point is a set of real questions and access rules, followed by a carefully bounded collection of sources.

[By Stolen Orbit](https://stolenorbit.com/en/about/) Updated 24 September 2026

[Let’s discuss your process](https://stolenorbit.com/en/contact/)

## Choose questions your documentation can actually answer.

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#questions)

A useful first scope is one question family: opening a service request, choosing an equipment checklist or requesting business travel. For each question, verify that an approved, current and understandable source exists. If the procedure lives only in a colleague’s memory, document it before introducing an assistant.

Retrieval-augmented generation, or RAG, retrieves relevant passages before generating an answer. It does not make every generated statement correct. Retrieval may find an obsolete version, the source may be ambiguous, and a citation may fail to support the sentence beside it. Those are different defects and need separate evaluation.

## Worked scenario: which returns procedure applies?

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#example)

Illustrative scenario: a team member asks how to handle a return for a discontinued product. The assistant finds the current procedure, shows its revision date and identifies the step requiring the commercial owner. If only an archived version exists, it explains that limitation instead of treating the old instruction as current.

Expected behaviour before release

| Question or condition | Expected outcome |
| --- | --- |
| Answer exists in the current procedure | A summary linked to the supporting passage |
| Two instructions conflict | An explicit conflict and an owner to consult |
| Information outside the approved collection | An explanation that the required source is missing |
| Document not authorised for this user | No retrieval, excerpt or citation from that document |

## Check permissions before content reaches the answer.

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#permissions)

Document visibility must be enforced during retrieval. Asking the model to keep already-retrieved confidential material secret does not replace access control. The scope should also cover snippets, links, caches and previous conversations when a person’s authorisation changes.

Azure guidance describes filtering search results by user or group identifiers and makes clear that the filter itself does not authenticate a user. Retrieval therefore needs a verified application identity. The appropriate implementation depends on the repository, available APIs and the organisation’s existing access model.

[Azure AI Search security filters and their limits](https://learn.microsoft.com/en-us/azure/search/search-security-trimming-for-azure-search)

## Build a testable path from sources to answers.

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#delivery)

1.  ### Curate the first collection
    
    Assign an owner, status, review date and audience to each collection. Define exclusions and what happens when a document is replaced, archived or deleted.
    
2.  ### Prepare questions and expected answers
    
    Include common questions, missing information, ambiguous requests and restricted topics. Evaluate retrieval, answer content, citation support and appropriate abstention separately.
    
3.  ### Run with a limited user group
    
    Collect unresolved questions and corrections without retaining unnecessary conversation data. Categorise each failure as a source, retrieval or answer problem so remediation addresses the underlying cause.
    

## Design the answers the assistant must decline.

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#boundaries)

Retrieved documents can contain instructions that try to redirect a model. OWASP explains that RAG does not eliminate this risk. The initial scope separates information retrieval from actions in business tools, and includes adversarial document examples in the evaluation set.

Traditional search may be enough for an exact code lookup. An assistant cannot maintain procedures that nobody owns. Ask for source maintenance, deletion handling and a clear path for unanswered questions in the proposal. For multilingual teams, evaluate the supported question and document languages explicitly.

[OWASP on instructions embedded in retrieved content](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)

FROM IDEAS TO A BRIEF

## A template to work from.

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#downloads)

### Knowledge source register

An approved source catalogue with authoritative versions, permitted audiences, update cycles and retrieval tests.

[Download the Markdown template](https://stolenorbit.com/downloads/knowledge-source-register-en.md)

### AI permission matrix

An identity–resource–operation matrix with justification, approver, negative tests and a revocation procedure.

[Download the Markdown template](https://stolenorbit.com/downloads/permission-matrix-en.md)

### AI evaluation dataset

A case register with verified expected results, judgement criteria and a separate set for the final evaluation.

[Download the Markdown template](https://stolenorbit.com/downloads/evaluation-dataset-en.md)

## Practical questions

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#faq)

**Can we connect an entire Drive or SharePoint repository?**

First check its structure, permissions, versions and available access. Start with bounded collections. A connector’s existence does not demonstrate that it correctly propagates every authorisation change or document deletion.

**How do we identify invented answers?**

Use a set of known-answer and unanswerable questions. Reviewers check whether each material claim is supported by its cited source. A visible link is helpful, but it is not sufficient evidence that an answer is correct.

## References and method

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#sources)

[Microsoft Learn — Security filters in Azure AI Search](https://learn.microsoft.com/en-us/azure/search/search-security-trimming-for-azure-search)

Technical context for identity-based result filtering; authentication and permission updates remain application requirements.

[OWASP — LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)

Risk of malicious instructions in documents consulted by a language model.

EXPLORE FURTHER

[Knowledge source register](https://stolenorbit.com/en/templates/knowledge-source-register/)

[AI permission matrix](https://stolenorbit.com/en/templates/ai-permission-matrix/)

[AI evaluation dataset](https://stolenorbit.com/en/templates/ai-evaluation-dataset/)

[AI implementation](https://stolenorbit.com/en/services/ai-implementation/)

[AI agents for business](https://stolenorbit.com/en/services/ai-agents/)

[AI agent or workflow: start with the decisions the job requires.](https://stolenorbit.com/en/resources/ai-agents-or-workflows/)

[RAG or fine tuning: first identify the error you need to fix.](https://stolenorbit.com/en/resources/rag-or-fine-tuning/)

[All practical guides](https://stolenorbit.com/en/resources/)

## Which process should improve first?

[Source for this section](https://stolenorbit.com/en/services/internal-ai-knowledge-assistant/#growth-closing-heading)

Start with a concrete process, the systems you use and the people who will operate it every day.

[Let’s discuss your process](https://stolenorbit.com/en/contact/)

## Turn the question into a next step.

-   [RAG or fine tuning](https://stolenorbit.com/en/resources/rag-or-fine-tuning/)
-   [AI agents or workflows](https://stolenorbit.com/en/resources/ai-agents-or-workflows/)
-   [Knowledge source register](https://stolenorbit.com/en/templates/knowledge-source-register/)