Why this study: I run a digital library that serves our entire company and built an in-house journal discovery tool that avoided $10,000+ in vendor cost. This design study is the next architectural step I mapped from that real work — how to layer generative AI over a governed knowledge base without breaking trust, permissions, or compliance.
The Problem
Enterprise knowledge is fragmented. Policies live in one system, research articles in another, SOPs in a third, and learning content in the LMS. Employees waste time searching, find outdated versions, or give up and ask a colleague. Generic AI chatbots make it worse: they answer fluently but without sources, without permission awareness, and without any guarantee the answer came from an approved document.
For employees
- 5–10 different places to search for one answer
- No signal for which document is current or authoritative
- High abandonment — “I’ll just email someone”
For the organization
- Knowledge investment underused; duplicate content created
- Ungoverned AI use risks hallucinated or leaked information
- No audit trail in a regulated environment
Reference Architecture
A retrieval-augmented generation (RAG) pipeline: the model never answers from memory — it answers from retrieved, cited passages of approved documents, filtered by the asking user’s own permissions.
1 · SourcesDocument library, LMS content, journal / research collections, SOPs & policies
→
2 · IngestionConnectors, parsing, chunking with metadata (owner, version, ACL, date)
→
3 · Vector StoreEmbeddings + hybrid keyword index; permission tags stored per chunk
→
4 · RetrievalQuery rewrite, top-k search, re-ranking, ACL filter applied before results return
→
5 · LLM + GuardrailsGrounded prompt, “answer only from sources,” refusal when evidence is thin
→
6 · Cited AnswersAnswer + inline citations, source links, confidence & feedback loop
Identity & SSO (cross-cutting)Enterprise SSO (SAML / OIDC) — the user’s identity travels with every query so retrieval can mirror source-system permissions exactly.
Audit & Observability (cross-cutting)Every question, retrieved chunk, and answer logged with user, timestamp, and model version — reviewable for quality and compliance.
Key Design Decisions
| Decision | Options Considered | Rationale |
|---|---|---|
| RAG vs. fine-tuning | Fine-tune a model on internal docs; RAG over a live index; hybrid | RAG. Content changes constantly and answers must cite a current source. Fine-tuning bakes in stale facts, can’t cite, and complicates deletion of retired documents. |
| Chunking strategy | Fixed-size splits; structure-aware (heading/section) splits; semantic chunking | Structure-aware chunking with overlap, preserving document hierarchy and metadata. Policy and SOP meaning lives in sections, not arbitrary 500-token windows. |
| Grounding & citations | Free-form answers; answer-with-sources prompt; strict extractive mode | Answer-with-sources: every claim linked to a retrieved passage, with a designed refusal (“I don’t have an approved source for that”) when retrieval confidence is low. Trust is the product. |
| Access control | One shared index for all; per-department indexes; ACL-filtered retrieval | ACL-filtered retrieval mirroring source permissions at chunk level. One governed index, but a user can never retrieve — or even infer — content they couldn’t open in the source system. |
| Build vs. buy | Vendor enterprise-search AI; fully custom build; platform + custom retrieval layer | Platform-first where commodity (SSO, vector infrastructure), custom where differentiating (ingestion quality, citation UX, evaluation). The same judgment behind building a journal finder in-house instead of buying one. |
Interactive Concept Demo
Select a question to see the response pattern the architecture produces — grounded answer first, citations always. Concept demo with sample content; not connected to live systems.
KNOWLEDGE HUB — CONCEPT DEMO
GROUNDED ANSWER
Access requests go through the library services intake form. Include the database name, business justification, and your cost center; requests are reviewed within five business days, and approved resources are added to the library catalog with SSO enabled.
Access requests go through the library services intake form. Include the database name, business justification, and your cost center; requests are reviewed within five business days, and approved resources are added to the library catalog with SSO enabled.
Sources: [1] Library Services — Database Access Procedure, v3.2, §2 · [2] Research Resources Catalog — Access & Licensing Notes
GROUNDED ANSWER
Completions must be recorded in the LMS within 10 days of the learning event, using the standard completion codes. Manager attestation is required for externally delivered training, and records are retained per the corporate retention schedule.
Completions must be recorded in the LMS within 10 days of the learning event, using the standard completion codes. Manager attestation is required for externally delivered training, and records are retained per the corporate retention schedule.
Sources: [1] Learning Operations SOP, §4.1–4.3 · [2] LMS Administration Guide — Completion Coding
GROUNDED ANSWER
Three recent items in the collection address retention in virtual settings. The consistent finding: spaced reinforcement at 7- and 30-day intervals and scenario-based practice outperform re-exposure to the same content. Full texts are linked below.
Three recent items in the collection address retention in virtual settings. The consistent finding: spaced reinforcement at 7- and 30-day intervals and scenario-based practice outperform re-exposure to the same content. Full texts are linked below.
Sources: [1] Journal collection — 3 articles matched, published 2024–2026, relevance-ranked · Retrieved via the library’s journal index
DESIGNED REFUSAL
I don’t have an approved source I can share for that. The documents covering launch timelines are restricted, and your current access doesn’t include them. If you need this for your role, you can request access through your manager — or I can connect you with the team that owns that content.
I don’t have an approved source I can share for that. The documents covering launch timelines are restricted, and your current access doesn’t include them. If you need this for your role, you can request access through your manager — or I can connect you with the team that owns that content.
No sources cited — retrieval returned zero chunks within this user’s permissions. The refusal is a feature: the system cannot leak what it cannot retrieve.
Security & Compliance
- Permission mirroring: chunk-level ACLs synced from source systems; retrieval filters before generation, not after.
- Data residency & model use: enterprise LLM endpoint with no training on customer data; embeddings and logs remain in the organization’s cloud tenant / region.
- PII handling: queries scanned for personal data patterns; the assistant is scoped to published knowledge, never employee records.
- Audit trail: immutable log of question, retrieved sources, answer, and user feedback — supporting quality review and regulated-industry inspection readiness.
- Content governance: only approved, versioned documents are indexed; retired versions are purged from the index on the source system’s signal.
Outcomes It Would Drive
Find time → answer time
One cited answer in seconds instead of searches across five systems — measurable in reduced time-to-information and fewer repeat questions to support teams.
Trustworthy AI adoption
Citations, refusals, and audit logs give compliance and skeptical users a reason to adopt — the pattern that turns an AI pilot into an AI platform.
Knowledge ROI
Usage analytics reveal which content actually answers questions and where the gaps are, so the library invests in what the organization needs.
A reusable pattern
The same governed RAG pattern extends to HR policy, quality, and R&D knowledge — architecture built once, value repeated.