An internal assistant has no judgment. It has your permissions.

What actually happens when someone asks a question

Most internal assistants rest on retrieval-augmented generation, an architecture formalized in the literature since 2020: the question becomes a search, a few document excerpts are retrieved, and those excerpts go to the model with an instruction to answer from them.

One consequence follows immediately, and teams often discover it late: the model does not know who is asking. It receives text. If the retrieval layer hands it an excerpt from a compensation memo, it will answer from that excerpt exactly as it would from a public procedure. Access control therefore cannot live in the prompt — it has to be applied at retrieval, using the identity of the person asking.

Microsoft's architecture guidance for these solutions makes the same point: security applies to the index and the query, not to generation. Politely instructing a model not to disclose something is not a control. It is a preference.

The assistant as an unplanned permissions audit

In a mid-sized organization, file shares carry fifteen years of accumulated access. A folder opened "temporarily" to the whole company in 2019. A team space inherited from a finished project. Permissions granted to a distribution list whose membership nobody has reviewed since.

None of that causes trouble while finding a document requires knowing it exists. An assistant removes that friction. What was theoretically accessible becomes genuinely reachable, in plain language, by anyone who asks the right question without knowing they are asking it.

An internal assistant does not create a leak. It makes usable what the organization had already stopped protecting.

Which is why an assistant project should start with an inventory of sources and their access model rather than a model comparison. The exercise is unglamorous and it pushes the project toward document governance — which is exactly where the work turns out to be.

Retrieved content is not a trusted source

A second mechanism is less intuitive. Because the model receives text and follows instructions, a document that itself contains an instruction can steer the answer. An archived email, a note pasted into a shared file, a page imported from an external site: any of them can carry a directive aimed at the assistant rather than at a reader.

OWASP's ranking of application risks for large language model systems puts that category — prompt injection — at the top of the list, alongside disclosure of sensitive information. These are not exotic scenarios. They are the two most common risks of any assistant wired into heterogeneous internal content.

Freshness outweighs the model

The last factor is the most mundane and the most decisive. An assistant answers with what it finds. If the 2021 procedure and its 2025 revision both sit in the document store, it will cite one or the other depending on how the question was phrased.

No model upgrade fixes that. What fixes it is a set of document management decisions: designate an authoritative version, remove or flag superseded ones, assign an owner responsible for keeping it current, and surface the source in the answer so a user can verify it.

This is the conclusion that surprises executive teams most: the perceived quality of an internal assistant depends mainly on the organization's document hygiene. A company whose procedures are maintained gets a good assistant from an ordinary model. A company whose documents contradict each other gets an assistant that repeats those contradictions — faster, and with more confidence.