Internal knowledge becomes useful when staff can find the relevant passage and understand where an answer came from. Until then it sits in inboxes, shared drives and one person's memory.
This work combines permission-aware retrieval, an assistant or API and business integrations, deployed inside a data boundary agreed with the organisation. It describes our approach and a representative scope. It is not a named customer deployment.
The problem
People re-answer the same questions and re-key the same data between tools. A general chatbot cannot be trusted with confidential documents, and a fluent answer with no source cannot be checked.
What the system does
- Ingestion of approved documents with access metadata, so a person only retrieves what they may read.
- Answers that cite the passages used and say when the documents do not contain the answer.
- A choice of where it runs: a server the organisation owns, a dedicated environment or an approved API provider under agreed terms.
- Integrations with the tools already in use, such as email, a CRM or a helpdesk, with approval before any action with side effects.
A representative journey
- Step 1: Select the documentsThe organisation names which sources are in scope, who may read each and who owns updates.
- Step 2: Ingest with permissionsText is extracted, split and indexed with access metadata. Removing a document removes it from answers.
- Step 3: Retrieve for the personA question retrieves only passages the asker is allowed to see, before any model is called.
- Step 4: Answer with referencesThe assistant writes an answer from those passages and shows which ones, including their dates.
- Step 5: Admit a gapWhen nothing relevant is found, the assistant says so and suggests who to ask, rather than guessing.
- Step 6: Act with approvalWhere an action is configured, such as drafting a reply, a person approves it before it is sent.
Agreed data boundary
- HR policy handbookAll staff
- Supplier contractsOperations only
- Client proposalsSales team
Extraction, index, retrieval, model, logs and backups each sit inside or outside this line, and it is written down.
Question from a sales team member
What notice period applies if a client cancels a proposal?
Proposals can be withdrawn with 14 days’ written notice. [1]
[1] Client proposals · Template v3, section 6 · updated 2026-03-02
Asked about supplier penalties: no passage you may read answers this. Ask Operations.
Working prototypeUse a small working version of this on invented data, the way a person would.
Try the prototypeInspect the system
This anatomy is a proposed description of how such a system is put together. It is not an audit of a specific deployment.
Inspect the system
How Private AI for business knowledge is put together
- What it is
- Source connectorsThe permitted document stores and records the assistant may read.
- What flows through it
- Files, emails and records are read with their owner and access rules.
- The decision
- Only named sources are in scope; everything else is invisible to the system.
Read the whole system as a list
- Source connectors. The permitted document stores and records the assistant may read. Flow: Files, emails and records are read with their owner and access rules. Decision: Only named sources are in scope; everything else is invisible to the system.
- Extraction and index. Turns documents into searchable passages with metadata. Flow: Text is extracted, split, embedded and stored with source, date and permissions. Decision: Every passage keeps its source and date so an answer can point back to it.
- Permission-filtered retrieval. Finds relevant passages for the person asking. Flow: A question and an identity go in. Only passages that person may read come out. Decision: Access is applied before generation, not requested of the model afterwards.
- Approved model. A local, dedicated or approved hosted model that writes the answer from the passages. Flow: A question and the retrieved passages go in. A cited answer, or a statement that evidence is missing, comes out. Decision: The hosting choice is made with the organisation and recorded per stage.
- Assistant, API and actions. The interface staff use and the integrations behind it. Flow: Answers and approved actions flow to staff and to connected tools, with an operational log. Decision: Actions with side effects wait for a person to approve them.
Key decisions
Filter by permission before generation
Access is enforced in retrieval. A model told to ignore a document it has already been shown is not an access control.
Say where every stage runs
Local inference does not by itself make a system private. Extraction, embeddings, retrieval, inference, logs and backups each have a location, and the boundary is written down.
Evidence or silence
An honest “not found” is better than a plausible answer. Missing-evidence behaviour is tested, not assumed.
Outcomes and limits
We publish no measured outcomes for this project, because we have none we can evidence. The description above is of what the system does, not of results it has produced.
- This is a representative approach. It does not describe a specific customer, dataset or measured accuracy.
- Answer quality depends on the documents, their freshness and the question. No accuracy figure is claimed.
- Which parts ran locally, on a dedicated server or through an approved API varies and is not stated for any one project.
Guardrail
Every answer cites its sources, and an action with side effects waits for a person to approve it.
Technical detail
Technology named in the portfolio for this kind of system. Which parts a given engagement used is not stated.
- RAG
- Node.js
- Python
- PostgreSQL / pgvector
- n8n
- AWS or a server you own