An AI Assistant for Your Own Staff: Answering From Company Documents Without Leaking Them
An internal AI assistant that answers staff questions from your own documents — policies, procedures, product specifications, templates — can save real time. The main risk is not wrong answers. It is answers drawn from documents the person asking was never allowed to see.
The design rule that controls that risk is simple to state. The assistant must apply each user’s existing permissions at the moment it searches, so it can never quote a passage the user could not have opened themselves. Add to that a curated set of sources, sensitive repositories left out by default, hosting and model terms you have checked, answers that cite their source, and logs that do not become a new leak.
This article covers how to build one safely. The customer-facing version is a different design with different risks, covered in how a custom business chatbot is actually built.
The short answer
- Enforce permissions in retrieval, not in the prompt. The assistant searches only what the user may open.
- Start with low-sensitivity sources — policies, procedures, product documentation — and add restricted ones deliberately.
- Keep the most sensitive material out by default: board papers, salaries, HR cases, legal disputes, health records.
- Cite every answer with a link to the source document and its date.
- Check where it runs and what the model provider’s terms say about training and retention.
- Treat questions as data: staff will type confidential things into it, so restrict and time-limit the logs.
What an internal assistant is good for
The strongest uses share a pattern: the answer exists in a document, but finding it takes longer than it should.
- Policy questions. “How many days of compassionate leave do we give?” “What is the approval limit for a branch manager?”
- Procedures. “How do I raise a purchase order for a new supplier?” “What’s the checklist for closing a branch at night?”
- Product and technical knowledge. Specifications, compatibility, installation steps, past answers to customer questions.
- Onboarding. New staff asking the questions they hesitate to ask a colleague for the fifth time.
- Drafting from templates. A first draft of a standard letter or quotation from the approved template, for a person to check.
It is weak, and risky, for decisions about people, legal or medical advice, and anything needing live figures from your systems unless it is properly integrated with them. Where to start with AI in a small business has a test for choosing the first process.
The confidentiality problem, in one sentence
If a document is in the assistant’s index and retrieval does not check permissions, anyone who asks the right question can get an answer from it.
That is not a theoretical concern. OWASP’s 2025 list of risks for LLM applications includes weaknesses in the vector stores behind retrieval, including inadequate access controls. Telling the model “do not reveal salaries” does not fix it. Instructions can be talked around, and the passage has already been retrieved by the time the model sees the instruction.
Permission-aware retrieval
The fix is to carry permissions from the source systems into the index and apply them on every search:
- Sync access rights with the documents. When a file is indexed, record which users or groups may open it in the source system — the document library, shared drive or intranet.
- Tag every chunk with those rights. A paragraph inherits the permissions of the document it came from.
- Filter at query time by the identity of the person asking, before anything reaches the model.
- Keep it in step. When permissions change at the source, or a document is deleted, the index must follow quickly. Stale permissions in the index are a leak waiting to happen.
- Test with real roles. Log in as a branch employee, a finance officer and a manager, and ask the same questions. The answers should differ exactly as their access does.
Done properly, the assistant becomes a faster way to find what each person can already see — never a way round the access rules. Those rules are the subject of who can see what: access control and audit trails.
Decide what goes in, and what stays out
Not every repository belongs in the first version. A sensible order:
| Tier | Examples | Approach |
|---|---|---|
| General internal | Policies, procedures, product documentation, approved templates | Include first |
| Department-restricted | Finance procedures, pricing rules, technical designs | Include with permission sync, after testing |
| Highly confidential | Board papers, salaries, HR investigations, legal disputes, health information, deal documents | Exclude by default; include only for a specific need, with narrow access |
There is a legal reason for care beyond common sense. Oman’s Industrial Property Law protects undisclosed information — trade secrets — where its holder has taken reasonable steps to keep it secret. An assistant that lets any employee query the pricing strategy or a confidential client contract works against that. Careful scoping and permission-aware retrieval are themselves part of the reasonable steps.
Personal data inside company documents
Company documents contain personal data: employee files, customer contracts, correspondence. Indexing them is processing under Oman’s Personal Data Protection Law, so the usual rules follow it into the assistant:
- Purpose. An assistant built to answer policy questions has no reason to index individual employee records. Leave them out.
- Erasure. When a document is deleted or its retention ends at the source, its chunks and embeddings must be deleted from the index too. Since September 2026, Oman’s law requires erasure once the purpose ends.
- Records. Add the assistant to your record of processing activities: what it indexes, who can use it, where it runs.
- Transfers. If the model or index is hosted outside Oman, sending passages containing personal data to it is a cross-border transfer with conditions. What your chatbot does with customer data explains them.
Where it runs, and on whose terms
Decide three things before building:
- Hosting. Where the index and the application run, and who administers them.
- The model provider’s terms. Whether your content may be used for training, how long inputs and outputs are kept, and where they are processed. Business terms commonly exclude training on customer content. Consumer accounts are governed by different terms, which is one reason staff should not paste company documents into personal AI accounts — the subject of a policy for staff using AI tools.
- Identity. Users sign in with their company accounts, so permissions and logs are tied to real people.
Answers people can check
An internal assistant earns trust when people can verify it quickly:
- Cite the source — document name, section and date, with a link.
- Prefer the current version. Where several versions of a policy exist, answer from the current one and say which.
- Say when it cannot find an answer, and suggest who owns the topic.
- Collect feedback on each answer, and route corrections to the document owner. Wrong answers often trace back to an outdated or contradictory document, which is worth fixing anyway.
Logging without creating a new leak
Staff will type sensitive things into an assistant: client names, salary questions, details of a complaint. The question log is therefore itself confidential.
- Restrict access to logs to the people who operate the assistant.
- Keep them only as long as their purpose requires, then delete them.
- Do not feed logged questions into analytics tools without removing personal data first.
- Review a sample regularly for quality, and for signs that someone is probing for information they should not have.
Rolling it out
Start with one department and one well-maintained set of documents. Measure whether it saves time and whether answers are right. Fix the documents it exposes as outdated. Then widen the sources and the audience in steps, testing permissions at each step. Tell staff plainly what the assistant is for, what it cannot see, and that their questions are logged.
Frequently asked questions
Can an internal AI assistant show staff documents they are not allowed to see? Only if it is built that way by mistake. With permission-aware retrieval, the assistant filters every search by the user’s existing access rights, so it can only quote documents the user could open anyway. Instructions in the prompt are not a substitute for that filter.
Which documents should we index first? General internal material — policies, procedures, product documentation and approved templates. Add department-restricted sources after permission sync has been tested, and keep highly confidential material such as board papers, salaries and HR cases out unless there is a specific, narrow need.
Does indexing company documents raise data protection issues? Yes, where documents contain personal data. Index only what the assistant’s purpose needs. Delete from the index when documents are deleted or their retention ends. Record the processing, and apply transfer rules if the model or index is hosted outside Oman.
Will the AI provider train on our internal documents? That depends on the terms you accept. Business API terms commonly exclude training on customer content, while consumer AI apps are governed by different terms. Check the specific terms and use business accounts only.
How do we stop the assistant giving wrong answers from old documents? Prefer current versions, show the source and date with every answer, and collect feedback that goes to each document’s owner. Wrong answers often reveal an outdated document worth fixing in any case.
Should the internal assistant be allowed to take actions? Start with reading and drafting only. Actions such as approvals or record changes add risk and need permission checks, confirmation and logging. Add them once the read-only version has earned trust.
This article states the position under the laws in force on 21 October 2026, the date of publication, and is not legal advice.
Sources: OWASP — Top 10 for LLM Applications · Royal Decree 67/2008 — Industrial Property Law (Arabic text) · Royal Decree 68/2026 amending the Personal Data Protection Law · Ministerial Decision 34/2024 — Executive Regulation of the PDPL (Arabic text)
Want an assistant that knows your documents and respects your access rules? ZAWAT builds AI and automation with permission-aware retrieval, cited answers and controlled logging. Book a call.