AI workflows and agents
Internal policy assistant (RAG)
Employees ask about policies and procedures and get an answer with its source, respecting access rights.
Fictional scenario. An example situation that illustrates the approach. It is not a client project and describes no measured results.
Business problem
A fictional company with a few hundred employees keeps policies in several systems. People ask colleagues or use outdated versions.
Assumptions
- Documents are in one or two stores with APIs.
- Access rights are managed centrally.
- Each policy area has an owner.
Constraints
- Answers only from approved documents.
- Employees see only what they are allowed to.
- Questions are not kept longer than needed.
Reference architecture
Components by stage — an illustration, not a running system and not a certified design.
01Input
- Document stores
- Metadata and permissions
02Indexing
- Chunking and embeddings
- Permission filters
03AI and rules
- Retrieval
- Instructed model
- Source check
04Output
- Answer with citation
- Feedback
The diagram as a list
| Stage | Components |
|---|---|
| Input | Document stores, Metadata and permissions |
| Indexing | Chunking and embeddings, Permission filters |
| AI and rules | Retrieval, Instructed model, Source check |
| Output | Answer with citation, Feedback |
Interfaces
| From | To | Via |
|---|---|---|
| Store | Indexer | Read-only API |
| Portal | Answer service | SSO session |
| Answer service | AI model | Adapter with masking |
Data flow
- Documents are indexed with their permissions.
- The question is enriched with the employee's role.
- Retrieval returns only permitted passages.
- The model answers only from the passages and cites them.
- No source — no answer.
Security boundaries
- Permission filtering happens before the model.
- The index holds no documents without an owner.
- Logs do not keep full questions.
Where a person approves
- A new source enters the index after its owner approves.
- A sample of answers is reviewed periodically.
Delivery phases
01 · Discovery
Sources, permissions and sample questions.
02 · Pilot
One department, a limited document set.
03 · Expansion
More sources and feedback.
04 · Operation
Evaluation set and index updates.
Limitations
- Not a substitute for legal advice.
- Owners must retire outdated documents.
Trade-offs
- Strict permissions vs answer completeness.
- Always citing — slower but verifiable.
Related services
Related assessments
Integration patterns used
Workshops and assessments
Facing something similar?
We start with an assessment of where you are and propose a realistic first phase.