An AI Assistant for SharePoint That Respects Permissions

What a SharePoint assistant actually does

Most "chat with your SharePoint" assistants follow the same pattern, usually called retrieval-augmented generation (RAG). Documents are split into passages and indexed. When an employee asks a question, the system searches that index, hands the best passages to a language model and asks it to answer only from them. The model does not learn your documents; it reads a handful of them per question.

That design makes the quality of the answer depend less on the model and more on three things: which documents the user is allowed to see, which documents are still valid, and whether the answer can be traced back to its source.

Permissions: the assistant must not know more than the user

SharePoint permissions are rarely clean. Sites inherit permissions, libraries break inheritance, individual files are shared via links, and "Everyone except external users" is attached to more content than anyone remembers. An assistant makes this visible instantly: a question about salaries or a reorganization can surface a file that was technically accessible but practically hidden.

• Trim at query time. Retrieval should filter results by the asking user's identity and group memberships, not by a service account that can read everything. Permissions copied into the index once at ingestion go stale; sync them or check them live.
• Fix oversharing before launch. Run a report of sites and libraries shared with large groups or via organization-wide links and clean up the worst cases first. The assistant is an excellent oversharing detector, but it should not be the one that finds it in production.
• Exclude by default. Start with a curated set of sites (policies, product documentation, IT knowledge base) and add more deliberately, instead of indexing the whole tenant.
• Respect sensitivity labels. If you use Microsoft Purview labels, decide which labels are never indexed or never passed to an external model.

Outdated documents are the quieter problem

A typical intranet holds three versions of the travel policy, a draft that was never approved and a PDF export from a retired site. Retrieval does not know which one counts. If you do nothing, the assistant will quote whichever passage matches the wording of the question best.

1. Use metadata you already have: modified date, content type, approval status, and the library the file lives in. Boost approved and recent documents in ranking.
2. Keep archives out of the index, or mark them so the answer says "archived" explicitly.
3. Give each critical document an owner and a review date. When an answer cites an expired document, the owner gets a task, not the user.
4. Collect "this answer was wrong" feedback with the cited source attached. Most bad answers trace back to a bad document, not a bad model.

Citations users can check in one click

Citations turn a plausible paragraph into something an employee can rely on. Each statement should link to the file, ideally to the page or section, and show the document title and date. When the retrieved passages do not contain the answer, the assistant should say so instead of filling the gap from general knowledge. This one rule prevents most of the confident nonsense that undermines trust in internal assistants.

Governance that survives the pilot

In the EU, also involve your data protection officer and, where one exists, the works council early: an assistant that logs employee questions touches both. This is a practical checklist, not legal advice.

When Copilot is enough, and when it is not

If your organization already licenses Microsoft 365 Copilot, it works within Microsoft 365 permissions and is a reasonable starting point for general productivity. A dedicated assistant makes sense when you need tighter control over which sources count, answers grounded only in approved content, workflows that act on the answer (create a ticket, draft a reply, update a record), or sources beyond Microsoft 365 such as SAP or a CRM.

How jocapps can help

kalAIDoCreate is our hardened AI orchestration platform with senior AI architects for enterprises and the public sector. It runs governed AI workflows integrated with SharePoint, SAP, HubSpot or Slack, so a document assistant can grow into processes rather than stay a standalone chatbot. For the broader rollout path, see our guide on implementing AI agents in the enterprise and the enterprise AI service. jocapps is ISO 27001 and ISO 9001 certified.

If you are scoping a SharePoint assistant, a free 30-minute intro call is a good place to test your use case and data situation.