An AI assistant should not treat every document as equally trustworthy. Organizations need clear rules for what employees may rely on, what remains under development, what requires limited access and what has been retired.
A company should separate its information into four controlled categories: published knowledge, working knowledge, restricted knowledge and archived knowledge.
Published knowledge may support official employee answers. Working knowledge remains in development. Restricted knowledge is available only to authorized roles. Archived knowledge is retained when necessary but removed from current guidance.
This separation helps prevent employees—and the AI tools assisting them—from relying on an unfinished draft, an obsolete procedure or information they are not authorized to access.
Why Can’t an AI Assistant Decide Which Document Is Correct?
An organization may have several documents that appear to answer the same question.
One policy might have been approved last month. Another may be a manager’s draft. A third could be an older version retained for historical reasons. A fourth may contain instructions intended only for HR or senior leadership.
To an employee scanning a search-results page, those differences may not be obvious. They may be even less obvious to an AI assistant unless the organization has defined which sources are authoritative and which content should be excluded from ordinary retrieval.
AI can locate, summarize and compare connected information. It does not inherently know which document leadership approved, whether an exception remains valid or why an older file was retained.
The organization must supply that context through content status, ownership, permissions and governance.
What Is Published Knowledge?
Published knowledge is information employees are authorized to rely on when doing their work.
Examples include:
- Approved policies
- Current standard operating procedures
- Official forms and templates
- Published onboarding guidance
- Current approval limits
- Approved customer-service instructions
- Safety procedures
- Departmental checklists
- Official escalation paths
- Current product or service information
Published content should have an identifiable owner and approval history. Employees should be able to determine who is responsible for its accuracy and when it was last reviewed.
Approval does not mean a document remains correct forever. A purchasing procedure approved two years ago may become outdated when the company changes accounting systems or approval limits. Published knowledge therefore needs review dates and a process for returning content to review when operations change.
SharePoint can support document approval and version controls. Microsoft’s guidance on requiring document approval in SharePoint explains that content awaiting approval can be kept from general users until an authorized reviewer approves it.
The technology can enforce the workflow, but the organization must still decide who is qualified to approve the information.
What Is Working Knowledge?
Working knowledge includes drafts, research, meeting notes and collaborative material that has not been approved for general reliance.
This information may be valuable. Employees need places to develop new procedures, revise policies and collaborate on projects. The mistake is allowing unfinished work to appear beside approved guidance without a clear distinction.
Examples of working knowledge include:
- A proposed revision to an employee handbook
- Notes from a process-improvement meeting
- A draft customer-response script
- Research collected for a future policy
- An unapproved checklist created by one department
- A procedure being tested in a pilot program
Working knowledge should be clearly marked and normally excluded from official AI answers.
That does not require deleting every draft. It requires preventing an assistant from presenting draft material as settled company policy. Appropriate controls may include separate libraries, status metadata, draft permissions, approval workflows and instructions limiting the AI knowledge source to published material.
The AskMaisy explanation of how governance works describes the use of statuses such as draft, review, approved and archived, along with knowledge owners, review dates, intended audiences and source links. These controls create a distinction between living working documents and the approved AI knowledge layer.
What Is Restricted Knowledge?
Restricted knowledge is information that should be available only to authorized people or roles.
Examples may include:
- Employee relations information
- Compensation guidance
- Financial procedures
- Legal advice and privileged material
- Executive planning documents
- Customer or patient information
- Security procedures
- Sensitive board records
- Department-specific operating instructions
Restricted does not necessarily mean unapproved. An HR procedure may be fully approved while remaining unavailable to general employees.
This distinction is important. Approval answers, “May someone rely on this information?” Restriction answers, “Which people may access it?”
A company should use role-based access wherever practical. HR, finance, executives, managers, employees, contractors and volunteers may each require different information.
An AI assistant should follow those access boundaries. It should not reveal restricted information through an answer, summary, citation, document title or suggested follow-up question.
Permission-aware retrieval does not repair an overshared SharePoint environment. Before connecting restricted sources, the organization must confirm that the underlying groups and permissions are appropriate.
What Is Archived Knowledge?
Archived knowledge is information that has been superseded or retired but must be retained for historical, operational, legal or regulatory reasons.
Examples include:
- Previous versions of policies
- Retired forms
- Procedures for discontinued systems
- Closed-project documentation
- Former pricing schedules
- Prior board-approved policies
- Historical training materials
- Records covered by retention requirements
Archived information should not normally support current employee answers.
An archived purchasing policy may be important during an audit, but it should not appear when an employee asks how to submit a purchase today. Keeping it in the same active retrieval source can create avoidable confusion.
Archiving is not the same as deletion. Organizations may have legal, contractual or regulatory obligations to retain certain records. Microsoft Purview provides retention policies and labels that can help organizations retain or delete Microsoft 365 content according to defined rules. Microsoft’s retention guidance for Microsoft 365 explains how retention policies and labels can be applied across services including SharePoint and OneDrive.
Records with significant business, legal or regulatory value may require more formal controls. Microsoft also recommends using records-management capabilities and retention labels to manage the lifecycle of high-value SharePoint documents.
Retention decisions should be approved by the organization’s qualified legal, compliance or records-management personnel. An AI implementation should not invent the retention schedule.
How Should a Company Put the Four Categories Into Practice?
The organization should begin with a limited, important knowledge area rather than trying to classify every file at once.
A practical starting point might be employee onboarding, purchasing, customer-service procedures or a frequently used set of operational forms.
For each item, the team should identify:
- Its current category
- Its business owner
- Its intended audience
- Its approval status
- Its effective or review date
- Its authoritative source location
- Any replacement or superseded version
- Whether it may support AI answers
Duplicate and conflicting documents should be investigated rather than silently moved into the published category. The appropriate owner must determine which version is correct.
The Pixeldust discovery and implementation process includes inventory, cleanup, ownership, permission review, user validation and continuing governance before and after AI enablement.
Who Is Responsible for Maintaining These Categories?
Technology administrators should not be solely responsible for deciding whether business information is correct.
Each knowledge area needs a business owner who understands the policy or process. Subject-matter experts may review specialized information. HR, legal, finance or compliance personnel may need to approve sensitive content. Platform administrators configure the libraries, metadata and permissions that enforce those decisions.
The organization also needs a method for reporting weak answers, missing procedures and conflicting sources. These reports should return to the appropriate knowledge owner for resolution.
Without continuing ownership, today’s published knowledge eventually becomes tomorrow’s outdated knowledge.
Which Information Should an AI Assistant Use?
An internal AI assistant should primarily answer from approved, published knowledge available to the employee asking the question.
Working drafts should normally remain outside official answers. Restricted knowledge should be retrieved only for authorized identities. Archived content should be excluded from current guidance unless the employee is deliberately conducting an authorized historical or records search.
The direct answer is simple: separate information according to whether it is approved, still being developed, access-restricted or no longer current—and attach ownership, permissions and lifecycle rules to each category.
An AI assistant can make company information easier to retrieve. The four-category model helps ensure that the information it retrieves is also appropriate to trust.
