Enterprise Knowledge AI: Search Staff Can Trust

Internal Search Is an Information-Control Problem

The promise is attractive: ask one question across policies, proposals, tickets, meeting notes and project files, then receive a concise answer with sources. The underlying problem is harder. Enterprise information is duplicated, differently permissioned, partly obsolete and often written for a context the searcher does not share.

As at 31 July 2026, retrieval-augmented generation can make that estate easier to navigate, but it cannot decide which record is authoritative or who should see it. A dependable service begins with information management and access control. The model is the final interpreter, not the system of record.

Choose a problem with observable cost, such as finding the current operational procedure or assembling prior responses to a standard client question. Do not begin by indexing every repository. Broad coverage before ownership usually increases plausible wrong answers and creates a new route around existing controls.

Establish Authority Before Ingestion

Create a source register before creating embeddings. For each collection, record its owner, purpose, audience, classification, retention rule, authoritative status, geography and update mechanism. Mark drafts, superseded versions and records under legal hold explicitly.

The ingestion path should preserve:

• stable document and version identifiers;
• source-system permissions and security groups;
• effective and expiry dates;
• page, paragraph or record location;
• owner and review date;
• sensitivity and personal-data flags;
• deletion and retention instructions; and
• the transformation history from source to searchable chunk.

If a policy is replaced, the old version may remain a record while no longer being valid operational advice. Retrieval should prefer the effective version and tell the user when historical material is being shown. The National Archives’ information-management assessment programme anchors good records practice in creation, management, retention and disposal rather than in search convenience.

Content preparation is a business control rather than a one-off migration. Give owners a queue for missing review dates, contradictory procedures and broken source links. Track the proportion of answers supported by material that is past its review date. When two approved sources conflict, do not let ranking conceal the disagreement: show both, identify their owners and route the issue for resolution. This feedback loop makes the knowledge estate better even when the immediate answer must abstain.

For a deeper view of relationships and canonical entities, see our guide to knowledge graphs and connected business data.

Permission Filtering Must Happen Before Retrieval

Post-generation redaction is not an access-control strategy. A user’s identity, device and current group membership should constrain the candidate set before any content reaches the model. Apply document-level permissions first and finer-grained controls where a file contains materially different sensitivities.

The NCSC’s zero-trust principles treat the network as hostile and require each request to be assessed against policy. For internal search, useful signals include identity assurance, device health, resource sensitivity and unusual query behaviour. Service accounts need their own narrow permissions; an all-seeing indexer creates a critical concentration of access.

Test:

• a leaver whose account remains in a downstream group;
• a contractor moved between projects;
• a manager searching for employee relations material;
• a shared link to a restricted answer;
• a source permission changed after indexing;
• an exported transcript or browser cache;
• cross-tenant and cross-department identifiers; and
• administrator access to embeddings and logs.

Permission updates should propagate within a defined service level. If synchronisation fails, fail closed for sensitive collections and expose the outage rather than serving stale access decisions.

Retrieval Needs Evidence and Abstention

An internal answer should cite the exact passages that support it. Retrieval quality must be measured separately from answer style, because a fluent model cannot repair missing evidence.

Build a gold set from real questions and include unanswerable examples. A high-quality service must say “I cannot find an approved answer” when evidence is absent or conflicting. Show source title, owner, effective date and location beside the response. Let users open the record and report a defect to its owner.

Avoid a single generic confidence score. Confidence should reflect evidence sufficiency, agreement, freshness and retrieval coverage, not the model’s probability of producing words.

Privacy, Rights and Retention Still Apply

Internal documents can contain employee, customer and supplier personal data. Indexing creates a new processing activity and may make information discoverable by people who could not realistically find it before. Define the purpose, lawful basis, minimisation approach and retention schedule; complete a data-protection impact assessment where risk warrants it.

The ICO’s data-minimisation guidance requires personal data to be adequate, relevant and limited to what is necessary. Its storage-limitation guidance rejects indefinite retention “just in case.”

Do not automatically store every prompt, retrieved passage and generated answer. Separate short-lived diagnostic telemetry from auditable business records. Mask unnecessary personal data in evaluation sets. Maintain a deletion path that removes content from source, index, caches and derived stores within a tested interval.

Subject access requests also matter. The ICO’s right-of-access retrieval guidance says organisations must conduct reasonable and proportionate searches. Know whether prompts, feedback and answer logs fall within scope and how third-party information will be reviewed.

Protect Against Poisoned and Hostile Content

Documents are not trustworthy instructions. A pasted prompt in a ticket, an adversarial PDF or a compromised connector can attempt to redirect the model, disclose secrets or invoke a tool. The NCSC guidance on AI and cyber security highlights prompt injection, data poisoning and confident factual errors.

Use a constrained architecture:

• parse and scan files in an isolated service;
• strip active content and reject unsupported formats;
• distinguish system policy from retrieved text;
• allow-list connectors, tools and outbound destinations;
• require user confirmation for any write action;
• keep secrets outside prompts and indexes;
• limit retrieval volume and query rate;
• detect unusual bulk extraction;
• pin and record model and pipeline versions; and
• maintain offline backups of critical configuration.

The UK AI Cyber Security Code of Practice provides baseline lifecycle measures for developers and deployers. Ask vendors for evidence against those measures, their subprocessor chain, data-use terms, vulnerability process and exit support.

Create an Operating Model, Not a Search Project

Name a product owner accountable for task outcomes and an information owner for each collection. Security owns the threat model and access assurance; privacy advises on lawful use and rights; records staff own retention and disposition; subject experts adjudicate answer quality; platform teams own reliability and rollback.

Run a weekly quality review during the pilot. Triage defects into source, permissions, retrieval, generation, interface and user-training causes. Fix the responsible layer. Re-prompting around an obsolete procedure only makes the wrong source sound better.

The service catalogue should state:

• included and excluded collections;
• intended user groups and purposes;
• maximum permission-sync delay;
• answer and citation limitations;
• supported languages and formats;
• log and feedback retention;
• incident and escalation routes; and
• planned model or connector changes.

Our guide to AI, archives and digital preservation provides additional patterns for maintaining provenance across long-lived material.

A Measurable 90-Day Pilot

Days 1–15 select one role and two high-value tasks. Baseline search time, escalation rate, error cost and document freshness. Inventory systems and nominate owners. Exclude collections without a defensible purpose or permission model.

Days 16–35 prepare content. Resolve duplicates, identify authoritative records, carry through permissions and design deletion. Create at least 100 representative questions, including historical, ambiguous, restricted and unanswerable cases. Define the minimum supported-claim and permission-leak thresholds.

Days 36–55 build a read-only prototype. No email sending, ticket closure or record modification. Run automated retrieval tests and adversarial access tests on every change. Subject experts score answers without knowing which configuration produced them.

Days 56–75 pilot with a small but representative staff group. Preserve normal search and support routes. Sample failures, not just liked answers. Compare verified task completion against the baseline and watch whether users over-trust concise responses.

Days 76–90 test continuity, deletion, source withdrawal and provider failure. Present results and open risks to the sponsor, information governance and security owners. Expansion should add one governed collection at a time.

Release and Pause Gates

Proceed only if there are zero confirmed cross-permission disclosures; authoritative-source coverage meets the agreed target; every consequential answer is traceable; stale-answer rates remain below tolerance; and verified task success improves without increasing operational error.

Pause retrieval from an affected collection when:

• its owner cannot confirm the authoritative version;
• permission synchronisation exceeds its service level;
• a deletion fails to propagate;
• prompt injection causes policy deviation;
• unsupported material claims exceed tolerance;
• the vendor changes data-use or residency terms;
• users act on answers without checking required records; or
• incident responders cannot reproduce an answer.

Maintain a kill switch by connector and collection. Rollback should remove the affected index, revoke credentials and return users to ordinary source search while evidence is preserved.

The Durable Advantage

Enterprise knowledge AI succeeds when it makes institutional truth easier to use without weakening the controls around it. Staff should spend less time hunting, yet remain able to distinguish an answer from an approved record.

The enduring asset is a governed knowledge estate: named owners, effective dates, inherited permissions, tested retrieval and a working disposition process. Once that exists, models can improve. Without it, a more capable model simply searches disorder faster.

Authoritative UK Sources

• The National Archives: Information Management Assessment programme
• The National Archives: Using AI for digital selection in government
• ICO: Data minimisation
• ICO: Storage limitation
• ICO: Finding information for a right-of-access request
• NCSC: Zero-trust architecture principles
• NCSC: AI and cyber security
• DSIT: AI Cyber Security Code of Practice
• GDS: AI Playbook for the UK Government

This article reflects guidance checked on 31 July 2026. It is not legal advice; public authorities, regulated sectors, legal holds and cross-border deployments require their own records, security and data-protection analysis.