Operating guide · AI and automation

Building an internal knowledge assistant with permissions, citations and evaluation

A controlled knowledge assistant for policies, procedures and service information.

Where things stand

The operating problem

A multi-site organisation has procedures across SharePoint, PDFs and shared folders. Staff lose time finding the current answer, but some sources are restricted, duplicated or out of date.

A better working position

The assistant has a clear subject boundary, retrieves only authorised and maintained sources, cites them visibly, refuses questions outside scope and is tested against questions staff actually ask.

Gaps to close

  • Improve retrieval without broadening access
  • Make answers traceable to current sources
  • Identify unanswerable questions
  • Avoid creating another unmanaged content copy
  • Give source owners a practical review workload

Decisions to settle

  • Authoritative source set
  • Permission enforcement method
  • Citation and refusal rules
  • Evaluation and update thresholds

How to know it is working

  • Unauthorised sources cannot be retrieved in tests
  • Answers cite approved sources
  • Unanswerable questions are handled safely
  • Source owners and review dates are active

Working documents

  • Source and access register
  • Assistant behaviour specification
  • Evaluation set and results
  • Content and service operating runbook

Putting the routine in place

  1. 01

    Knowledge governance

    Choose a bounded domain, name source owners, classify access and remove or mark duplicates and superseded material.

  2. 02

    Retrieval and access design

    Index approved content with source metadata and enforce the user's information boundary at retrieval time.

  3. 03

    Evaluation

    Test correct, ambiguous, stale, unauthorised and unanswerable questions and score retrieval and answer failures separately.

  4. 04

    Pilot operation

    Release to a limited group, monitor use, feedback, incidents, source decay and refusal behaviour.

  5. 05

    Content operations

    Give source owners a review queue and define what happens when a source expires, moves or conflicts with another approved source.

Useful operational references

  1. Australian Government — Voluntary AI Safety Standard
  2. Office of the Australian Information Commissioner — Small business and the Privacy Act

A practical next step

Plan the work around the real environment.

Share what is not working, what is changing or what decision needs to be made. Technical answers can come after the business context is clear.