Internal AI Assistant: Permissions, Integration and Costs

An internal AI assistant is worth considering when employees repeatedly search for the same procedures, product details or operational guidance. The attractive demonstration is a fluent answer from company documents. The useful business outcome is an employee finding the correct information they are authorised to see, with a source they can inspect and a clear route when the answer is uncertain.

An internal AI assistant can help staff find and summarise approved company knowledge, but it needs reliable documents, enforced permissions and measurable acceptance tests. Check your existing software before commissioning a separate system. Start with a limited, read-only workflow and evaluate correct task completion, not how confidently the assistant writes.

Define the employee task before choosing the technology

Choose a specific question people struggle to answer today. A support employee might need the current escalation procedure. An account manager might need an approved product specification. Those tasks require different sources and access rules. A request to connect every company document at once makes scope difficult to control and hides what success should mean.

Write down the current route: where the employee searches, who they ask and what makes an answer acceptable. Include situations where a document is missing or contradictory. The assistant should improve that process rather than create another destination with the same unreliable content behind a more convincing interface.

Our RAG explainer covers the underlying retrieval pattern. This guide addresses the implementation decision: which systems need connecting, which people may use the information and what a supplier must demonstrate before the workflow becomes part of everyday work.

What an internal AI assistant should retrieve and cite

Use an approved source set with identifiable owners. Preserve document titles, locations, versions or update information so an employee can inspect the evidence behind an answer. A summary without a usable source can shift verification work onto the user while making an unsupported statement sound more authoritative.

Amazon Bedrock’s knowledge-base documentation describes generated responses with citations to source data. That illustrates a useful capability, not a guarantee that every generated claim is supported. Your evaluation must check whether the cited passage actually establishes the answer and whether the employee can open it.

Ask the assistant to distinguish what the documents state from what it infers. When the material does not settle the question, it should say so and offer the relevant source or owner. Do not reward a system for filling every gap with plausible prose. Abstaining can be the correct result.

Enforce permissions before private content reaches the model

Signing in is only the beginning. The retrieval process must limit documents to those the requesting employee may access. Telling the model not to reveal restricted content after that content has entered its context is an inadequate substitute for preventing retrieval in the first place.

Microsoft’s security-filter documentation describes filtering search results using user or group identifiers. It explicitly explains that the filter pattern itself does not authenticate the user. Your application must establish identity and trustworthy permissions, then enforce the appropriate restriction on every relevant query.

Include changes in your design. A person can move teams, lose access or leave the company. Documents can become restricted after indexing. Define how those changes affect the index, caches and conversation history, and test that an old answer or shared session does not become a route around current access policy.

Keep current policies ahead of obsolete drafts

More documents do not necessarily create better answers. An old procedure, an unsigned draft and an approved current policy may all use similar words. Without status and ownership, retrieval can select a convincing but obsolete passage. Decide which material is authoritative before adding it to the assistant.

Define what happens when a source changes or disappears. The connector should update or remove the indexed copy, with visible failures rather than silent drift. Assign an owner to review stale material. A search index is another copy of business information, so its freshness needs operational responsibility.

For conflicting guidance, preserve the conflict and escalate rather than averaging instructions together. The assistant might point to the current approved procedure and note that another document disagrees. A responsible employee should resolve the source problem. The model cannot decide a company’s policy authority merely from writing style.

A worked example: finding an escalation procedure

Imagine a support team asking how to escalate an unusual customer issue. Its approved procedure identifies the responsible team, required context and communication channel. A private management note discusses a different matter, while an older draft names a previous owner. This is a hypothetical acceptance scenario, not a client result.

The useful response summarises the authorised current procedure, cites it and leaves the employee able to inspect the original. It should not draw on the management note or follow the obsolete draft. If the current procedure does not cover the unusual issue, it should direct the employee to the named owner instead of inventing a new rule.

The table turns that example into acceptance cases. Test both successful answers and deliberate boundaries. A convincing demonstration on unrestricted documents is not evidence that a mixed-permission knowledge system behaves correctly, especially when the test omits the cases it should refuse or escalate.

Choose existing software, a connector or a dedicated assistant

Begin with the search and assistant features in the software you already use. If the task stays within a supported workspace and those features satisfy access and evaluation requirements, configuration may be sufficient. Verify your actual subscription and deployment rather than assuming that a product demonstration applies to your organisation.

A connector is useful when approved knowledge sits across systems or the employee needs a response inside an existing application. A dedicated assistant becomes more relevant when the task needs specialised retrieval, careful source selection or controls unavailable through simpler configuration. It also creates responsibilities for hosting, monitoring and maintenance.

Choose based on the demonstrated gap. Ask suppliers to show how their proposed route handles your own permission and freshness cases. The options below are implementation patterns, not promises about a specific vendor’s feature availability or pricing.

Estimate integration and recurring costs separately

Implementation work includes source discovery, data preparation, identity integration, permission mapping, retrieval design and evaluation. Poorly organised documents and inconsistent access rules can increase that work even when the chat interface is simple. Ask for an explicit source and user scope rather than pricing a vague company-wide assistant.

Recurring costs include model usage, retrieval and indexing, hosting, relevant subscriptions, monitoring and people maintaining sources and tests. Measure query volume, document change frequency and the time staff spend checking or correcting answers. A low generation bill does not establish low total cost if content upkeep is ignored.

Request separate quotes for discovery, a limited pilot and production rollout, with recurring assumptions expressed in GBP for comparison. The fine-tuning, RAG and prompting guide helps distinguish the underlying approaches. This article does not invent a universal implementation fee or claim that recovered time automatically becomes a cash saving.

Protect the workflow from instructions inside documents

Treat retrieved text as data, not authority to change the assistant’s behaviour. A document can contain instructions to ignore policy, expose another source or perform an action. An employee may retrieve that text without knowing it is hostile. The system must preserve the boundary between application rules and material being summarised.

OWASP’s prompt-injection guidance recommends least privilege and approval for high-risk actions. Start with read-only access and keep credentials and permitted operations in application code. A knowledge assistant does not need permission to change customer records simply because it can explain a procedure involving those records.

If you later add actions, scope them separately with explicit authorisation, validation and recovery. Test hostile documents alongside ordinary questions. Review logs and retention so sensitive text does not spread through debugging tools or shared histories. These are proposed engineering controls, not a promise that prompt injection has been eliminated.

Run a pilot that measures useful answers

Build evaluation questions from actual employee tasks, including questions with no answer, conflicting sources and different access groups. Have source owners specify acceptable evidence and responses before testing. Keep final evaluation cases separate from the examples used to adjust retrieval or instructions, so tuning does not masquerade as general reliability.

Begin with a small source set and authorised pilot users. Measure supported answers, correct refusals, useful citations and time to complete the task. Check whether staff can verify the response without reopening the entire investigation. Test the relevant languages and ambiguous wording your employees really use.

Agree acceptance conditions and an operational owner before expanding. Include a fallback to ordinary search or the responsible person, a way to pause the assistant and a process for reporting unsupported answers. A pilot can succeed by showing that simpler configuration is sufficient; it does not have to justify a larger build.

Commission an assistant around a defined business workflow

Prepare anonymised sample questions, approved source examples, access groups and a description of today’s search process. Explain which answers matter, what must stay private and how quickly updates should become visible. This allows an integration supplier to assess the actual work rather than quote from an attractive generic demonstration.

Mecanik’s AI integration services can help scope connections between an assistant, existing applications and controlled business information. Request a defined assessment covering source readiness, permissions, acceptance evidence and maintenance. Start with a workflow the business can own and evaluate before committing to company-wide adoption.

Frequently Asked Questions

Do we need to train a custom model for an internal AI assistant? Not necessarily. Start by checking existing software and retrieval from approved sources. Commission additional model work only when evaluation demonstrates a requirement that simpler configuration and integration cannot meet. The assistant’s permissions and source quality still need attention regardless of the model.

Can every employee use the same knowledge base? They can share infrastructure, but retrieved information must respect each employee’s access. Define trusted identity, permission updates and isolation for caches and sessions. A shared index does not mean everyone should receive the same documents or answers.

Do citations guarantee a correct answer? No. Check that the cited passage supports the statement, is current and is accessible to the employee. A citation can point to irrelevant or obsolete material. Evaluation must assess support and source quality, not simply count links.

What determines internal AI assistant costs? Source preparation, identity and permissions, connectors, evaluation and maintenance determine much of the scope. Separate implementation from model usage, retrieval, hosting and human upkeep. Request a scoped GBP quote based on your sources and measured usage instead of assuming a universal price.

Should the assistant be allowed to update business systems? Start read-only. Actions require a separate scope with explicit authorisation, validation, approval where appropriate and recovery. The ability to summarise a procedure does not automatically justify permission to execute it or change customer data.