Ask once, see the source, and never see a file you are not cleared for.
Master directions, regulator circulars, internal policies, SOPs and engineering standards are scattered across SharePoint, file servers, wikis and business systems. We would build retrieval that honours the access rights of each source and answers with citations, or states clearly that the sources do not support an answer.
For Indian organisations whose guidance is spread across systems, departments and languages, and whose access rules must hold.
Owners approve the sources, which are linked with their access rights and indexed with metadata. A user asks a question and retrieval returns only passages that user may open. If the passages are thin or disagree, the question passes to the topic owner; if not, the answer cites them. Ratings and corrections improve both the sources and the test set.
Before and after
How the working day changes
Today
With the system
Today
Today: A search that returns hundreds
Keyword search lists every file containing the term, including drafts, copies and circulars that were withdrawn long ago.
With the system
With the system: Short answers, cited
Every answer quotes the passages behind it, links to them and shows the date each source was last reviewed.
Today
Today: Answers held by a few seniors
The quickest route is still the colleague with the longest service. That route cannot grow with the team, and it leaves when the person does.
With the system
With the system: Access rights travel with the text
Results are filtered by the user’s own permissions at the moment of asking, so one common index never turns into a common leak.
Today
Today: Answers nobody can verify
People repeat what they recall, and no one can say which version of a circular or SOP the answer rested on.
With the system
With the system: Declining when evidence is thin
Where the material falls short, the assistant admits it and hands the query to whoever is responsible for that subject.
Today
Today: Sources in several languages
Government orders may be issued in Hindi or a State’s official language, while the question is typed in English.
With the system
With the system: Search across languages
A question in English can find a passage in Hindi or another Indian language and receive an English answer that cites the original passage; each language is tested before it is enabled.
Workflow
Step by step
The quality of the sources matters more than the choice of model. The flow therefore begins with owners choosing what is indexed and ends with feedback returning to them.
Illustrative workflow
7 steps · 2 human checkpoints
Legend
System
Person
Human checkpoint
Exception path
Enterprise knowledge: illustrative flow with a decline path
Read the diagram as text
Approved sources are linked and indexed with metadata; a user then asks, retrieval stays within that user’s permissions, the answer cites its passages, and feedback closes the loop.
The first point where a person decides comes before indexing: an owner must approve each source.
If retrieval returns too little evidence or sources that disagree, no answer is generated. The question passes to the topic owner, who replies and decides whether a source must change, and the case then joins the feedback step.
01
Step 1: Link approved sourcesSystem
Connectors read SharePoint sites, wikis, file servers, ticket history and ERP document stores, and copy the access-control list of each item along with its content.
Human checkpoint
Nothing is indexed until the owner of a source has approved it and its boundaries. When a circular or SOP is withdrawn, its entry leaves the index too.
02
Step 2: Index with status and ownerSystem
Documents are divided along their headings and clauses and tagged with owner, language, status (draft, in force, superseded) and review date. One hybrid index serves both keyword and vector search.
03
Step 3: Ask where you workPerson
Questions come from familiar places, such as the intranet, Microsoft Teams, a service console or a line-of-business application, and carry the asker’s identity with them.
04
Step 4: Retrieve within permissionsSystem
The query is widened across languages, filtered by what the user is entitled to see and re-ranked. Superseded circulars are left out and contradictions between sources are flagged.
05
Step 5: Pass to the topic ownerPerson
Thin evidence or two sources in conflict send the query to the person who owns that subject, together with the passages found.
Exception path: Thin or conflicting evidence· Returns to step 7
Human checkpoint
The assistant declines rather than guesses. A person replies and decides whether a source should be written, revised or withdrawn.
06
Step 6: Answer with referencesSystem
A brief answer is written from the retrieved passages only. Each statement links to its source, showing the owner of that source and its review date.
07
Step 7: Learn from feedbackSystem
Ratings, corrections and referred questions are turned into test cases. Groundedness and citation accuracy are measured again before retrieval or prompts change.
Components
Components we would deliver
01
Source connectors that carry permissions
Connectors that sync changes incrementally and bring each item’s access list, its deletion and its version status into the index.
Query rewriting, entitlement filters applied when the question is asked, re-ranking, and answers built only from evidence, with citation checks and the option to decline.
Deployment in your tenancy and chosen region, private network paths to sources and model endpoints, and no training of external models on your content.
Directory and groups (Microsoft Entra ID or equivalent)
Knowledge articles and console in Salesforce Service CloudPlatformSalesforce
Documents and business objects held in SAPPlatformSAP
The intranet and Microsoft Teams
IT service management tool
Controls
Controls built in
Access boundaries
Access rights are never merged into a single common index. Every item keeps its own access-control list, and each query is filtered by the user’s identity and group membership at the moment it is asked.
Sensitive areas such as HR, vigilance, legal and information security can be left out altogether or indexed only for their own audience.
Human review
Owners decide what goes into the index and are alerted to unanswered questions and conflicting sources. For high-impact domains such as regulatory compliance, answers can be restricted to exact quotations.
Auditability
For each answer the log keeps the question asked, the passages found, the sources cited, the model and prompt version and the rating the user gave, for as long as your retention period allows.
Data protection
Personal data in source documents remains under that source’s access rules, which supports the purpose limitation the DPDP Act expects of a Data Fiduciary. Logs are pseudonymised where possible, and none of your content trains external models.
AI transparency
The interface says plainly that answers are produced by an AI system, displays the sources for each answer and lets users flag a wrong one in one step.
Measures
How success would be measured
We settle these measures with you during discovery, using actual questions gathered from the teams that will use the assistant.
How success would be measured
Metric
Why it matters
How we would measure it
01Groundedness
Why it mattersAn answer that its sources do not support does more harm than no answer at all.
How we would measure itProportion of answer statements backed by the passages cited, rated against the question set and through spot checks by reviewers.
02Citation accuracy
Why it mattersUsers must be able to check an answer with a single click.
How we would measure itProportion of citations that lead to the passage which actually backs the statement.
03Questions resolved
Why it mattersShows whether people get what they came for, not merely whether text appears.
How we would measure itRatings, repeat questions and hand-offs to owners in each domain, drawn from usage logs and user feedback.
04Time taken on set tasks
Why it mattersLinks the assistant to real work, such as a branch officer checking a KYC rule while the customer waits.
How we would measure itA stopwatch comparison before and after go-live, using a fixed list of representative questions.
No targets are set before a baseline exists.
Rollout
Phased rollout
Phase 01
Discovery and source audit
One domain with clear owners, such as compliance circulars or HR policy. We gather real questions and assess the condition of the sources.
Exit criteria
Sources and owners confirmed
Question set gathered
Permission model checked with information security
Phase 02
Pilot for one team
The assistant serves one team, through one interface, on approved sources only.
Exit criteria
Groundedness and citation targets reached
Access tests show no leakage
Owners act on feedback
Phase 03
Add domains
Each new source or audience joins only after the same check of owners, permissions and test questions.
Exit criteria
Question set for each domain
Review cycle agreed with owners
Phase 04
Run and hand over
Monitoring, test runs and owner reports pass to your team, with a named owner for the service.
RBI master directions, SEBI circulars and internal policies for compliance teams, branch staff and operations.
Illustrative example
Circulars for the compliance team of an NBFC
Situation
The compliance team of a non-banking financial company tracks RBI master directions, circulars and internal policies across shared drives and email. Branch and operations staff send it the same questions every week.
System
An assistant in the intranet would answer only from the directions in force and the company’s own policies, citing the paragraph it relies on and flagging any superseded text.
Human control
The compliance team would own and approve every source before indexing. Questions the sources do not settle would go to a named compliance officer instead of being answered by the assistant.
What we would measure
Groundedness and citation accuracy on a question set per policy area, and the number of questions referred to compliance.
India
Regulator circulars, State orders and group policies
Compliance teams at banks, NBFCs and market intermediaries work from a steady flow of RBI master directions and SEBI circulars, while State departments issue orders in English and the State language. Indian groups with European subsidiaries add policies written under EU rules. We design retrieval that keeps the permissions of each source intact, cites the paragraph it relies on and marks superseded circulars, so staff act on the version in force.
Personal data in those sources falls under the DPDP Act, with Data Fiduciary duties applying from May 2027, and under the GDPR for European entities. Where an assistant informs staff, we document how answers are produced and tested, in line with the transparency duties of the EU AI Act and with the non-binding India AI Governance Guidelines that MeitY released in November 2025.
01How do you ensure people see only what they are cleared to see?
Access-control lists are copied from each source and enforced when the question is asked, using the user’s identity. We test this directly: before a pilot opens, we run access tests with accounts from different groups and confirm that nothing crosses over.
02What happens when an answer is wrong?
Wrong answers will occur, so each answer shows its sources and a user can flag a problem in one click. Flags reach the content owner and become test cases. When evidence is thin, the assistant is built to decline instead of guessing.
03Our office suite already includes an assistant. Is a separate one needed?
Often there is no need. If nearly all your content sits in that suite and its assistant meets your quality bar, we help you set it up and govern it. A separate service pays off when sources are spread over several systems, when you need to control retrieval and testing yourself, or when rules on where data may sit exclude the standard option.
04Our documents are untidy. Must everything be cleaned first?
No. In practice the bottleneck is usually how content is governed. We start with a single domain, label drafts and superseded circulars, and send owners regular reports on duplicate and outdated material, so quality rises first where it matters most.
05Can it answer from sources in Hindi and other Indian languages?
It can be designed to. Multilingual embeddings and query expansion find passages in other languages, and the answer comes in the language of the question with citations to the original text. Each language is added only after its own question set shows acceptable quality. Where translation is part of the design, Bhashini, the national language platform, is one option to evaluate.
06How long would a pilot run?
Mostly as long as it takes to get access to sources and owners. We agree the pilot scope and exit criteria in discovery. Our delivery model sets out the phases, and AI Engineering & GenAI describes the engineering behind retrieval.
Share your knowledge sources
Tell us where your guidance is stored and who needs it. We will review sources, permissions and languages with you and propose a first domain.