- A good assistant answers from your own documents and data, and says so when it doesn't know.
- Internal assistants must respect who can see what. That's often the hardest part.
- Customer-facing assistants need a clear, fast handoff to a person.
- Your company is responsible for what its assistant says. Plan for that.
- Off-the-shelf tools fit many cases. Custom work fits scattered sources, strict permissions or actions in your systems.
Two kinds of assistant
Most requests fall into one of two shapes.
An assistant for your team. A new project manager wants to know how change orders get approved. A dispatcher needs the procedure for a specific customer site. Someone in HR is asked the same benefits question for the fifth time this week. The answers exist, scattered across SharePoint, a wiki, old emails and the heads of three senior people.
An assistant for your customers. Someone wants to know their order status, your return policy or if you service their area. It's 10 p.m. and your support team went home hours ago.
The technology underneath is similar. The risks, the setup and what "good" looks like are different. Decide which one you're building first.
Grounding: answers from your information
A general AI model knows a lot about the world and nothing about your company. Ask it your refund policy and it will produce a plausible one. That plausible answer is the danger.
The fix is grounding. Before the assistant answers, it searches your own documents and data for the relevant passages, then answers from those. A well-built assistant shows where each answer came from, so a person can check it.
Grounding only works as well as the material behind it. If your policy documents contradict each other, the assistant will too. If the procedure in SharePoint is three years out of date, so is the answer.
So the first job is often unglamorous. Find the documents that matter. Retire the stale ones. Name an owner for each area who keeps it current. That work pays off for your people even without the assistant.
Then teach the assistant to say "I don't know." An assistant that admits a gap and points to a person is far more useful than one that fills the gap with a guess.
Permissions: who can see what
For internal assistants, this is where most of the real work sits.
Your file systems already have permissions. Finance folders are restricted. HR files are restricted further. An assistant that searches everything and answers anyone breaks those rules in a single question: "What did we pay the last person in this role?"
A sound internal assistant checks who's asking and only searches what that person could already open. It inherits your existing permissions instead of inventing new ones.
This is easy to say and fiddly to build, especially when information lives in several systems with different permission models. Ask any vendor exactly how they handle it, and test it with a few accounts that should see different things.
There's a newer risk too. If the assistant reads documents or emails from outside, someone can hide instructions in them. OWASP lists this, called prompt injection, at the top of its risks for AI applications. Keep the assistant's abilities narrow and don't let it act on what it reads without a check.
Customer-facing: the handoff matters most
A customer assistant succeeds or fails at the moment it can't help.
Good handoff looks like this. The assistant recognizes it's out of its depth, or the customer is frustrated, or the question involves money, safety or a complaint. It says so plainly and passes the conversation to a person, with the history attached, so the customer doesn't repeat themselves. Outside working hours, it says when someone will reply and actually creates the ticket.
Bad handoff is an assistant that keeps trying, or loops the customer through the same three suggestions.
Be clear about what it shouldn't say at all. Prices it can't confirm. Promises about delivery dates. Legal or medical advice. Anything about refunds that isn't in your written policy.
That last point has real teeth. In 2024, a Canadian tribunal held Air Canada responsible for wrong information its website chatbot gave a customer about a fare policy. The airline argued the chatbot was responsible for its own statements. The tribunal disagreed. Your assistant speaks for your company.
Our customer support page covers what an assistant can do alongside your support team, including order lookups and ticket triage.
When the assistant does things
Answering questions is one level. Taking actions is another. Looking up an order status, booking an appointment, opening a support ticket or updating an address all mean the assistant touches your real systems.
That's where a lot of the value is, and where care matters most. Each action should be narrow and specific. "Look up this customer's open orders" is safer than "access the order system." The assistant should confirm with the person before it changes anything, and every action should be recorded.
For customers, confirm who they are before showing anything personal. An order number and a postcode is a common minimum. For staff, the assistant acts with the same permissions the person already has, never more.
Start with actions that only read. Add actions that change things once you trust the answers.
Measuring answers
"Users seem to like it" is not a measure. Plan how you'll judge answer quality before launch.
- A test set. Write down fifty or a hundred real questions with the correct answers. Run them before launch and after every change.
- Sampled review. Each week, someone who knows the subject reads a sample of real conversations and marks the answers right, partly right or wrong.
- Unanswered questions. Track what people ask that the assistant can't answer. That list tells you which documents to write next.
- Handoff rate and reasons. For customer assistants, how often it passes to a person, and why.
- Feedback buttons. Useful, but people rarely click them. Don't rely on them alone.
NIST's guidance on generative AI risk makes the same broad point: test before launch, then keep monitoring once it's live.
Off-the-shelf or custom
Many good options exist, and you may already own one.
- Assistants built into your existing tools. Microsoft 365 Copilot and Google's Gemini work across your company's files and email within your existing permissions.
- Assistant builders. Tools like Microsoft Copilot Studio let you build an assistant on your own sources with little code.
- Help desk assistants. Support platforms like Zendesk and Intercom offer AI agents that answer from your help center and hand off to your agents.
These fit when your information already lives in one place and the questions are mostly lookups.
Custom work fits when:
- Answers need information from several systems, like your ERP, scheduling and a document library together.
- Permissions are complex, or span systems the built-in tools can't read.
- The assistant needs to do something: look up an order, book a slot, create a ticket.
- You need a full record of what was asked, what was answered and which sources were used.
Our AI systems page covers how we approach this.
Who needs to be involved
An assistant is not only an IT project. Plan for a few people beyond the builders.
- A content owner for each subject the assistant covers, who keeps the source documents right.
- Your IT or security lead, to confirm permissions, sign-in and which AI provider is approved.
- Someone from support or operations who knows the real questions and reviews answers each week.
- Legal or compliance, for customer-facing assistants, to agree on what it must never say.
None of these roles is full time. All of them matter more than which model you pick.
Rolling it out
Launch to a small group first. For an internal assistant, that might be one team and the people who know the subject best. They'll spot wrong answers fast and tell you plainly.
For a customer assistant, start with a slice of traffic or a single page, like order status. Watch handoffs and sampled answers closely for the first few weeks.
Write down the rules it follows: what it answers, what it won't, when it hands off. Share them with your support team, so they know what customers have been told before they pick up a conversation.
Then widen it in steps, adding sources and questions as the measurements support it.
What most guides miss
Start narrow. An assistant that answers one department's questions well beats one that answers everything badly. Pick a single area with good documents and a clear owner.
The content owner matters more than the model. Someone has to keep the source documents right. Without that person, answer quality slides month by month.
Internal first is often smarter. An assistant for your own team is lower risk, gets real feedback fast and builds the clean sources a customer assistant will need later.
Know which AI provider sees what. Check your provider's terms on data use and retention, and keep sensitive material out of anything that isn't covered by your agreement.
How we do it
We start with a free intro call about who will use the assistant and what they ask most. Then we work alongside your team to sort the sources, set permissions and agree on how answers will be checked. We stay on after launch to review answers and keep the sources current. Start with an intro call.
