You’ve built a knowledge base, connected your AI to business data, and your team is asking questions through natural language. Great. But have you defined what the AI is allowed to say, to whom, and under what conditions?
Before connecting business data, review which users and actions the assistant is allowed to serve. Confidential pricing, client details, and internal financials need explicit access boundaries and tests that verify them.
AI governance isn’t bureaucracy. It’s the difference between a useful tool and a liability.
Rule 1: Define Access Levels Per Role
Not every employee should see the same data through AI. A typical structure includes an executive tier with access to financials, margins, strategy, and client terms; a staff tier with access to operations, processes, pricing (but not cost breakdowns), and templates; and a public or client tier limited to product specs, public pricing, and general company info.
Role-specific prompts and separate knowledge collections organize the assistant's context. Enforce permissions in the data source and retrieval path as well, so information unavailable to a role is not supplied to its model context. Our device-specific Claude Projects provide role instructions; those instructions complement access controls.
Rule 2: Tell the AI What NOT to Share
Positive instructions (“you have access to pricing”) are not enough. You need explicit negative boundaries: never reveal exact profit margins to non-executive users, never share client names or contract details outside the sales team, never disclose partner agreements or vendor costs, and never generate responses that could be interpreted as legal or financial advice.
Make the prompt boundaries specific, then test attempts to cross them. Treat instructions as guidance for model behavior; use access controls and output review for restrictions that must hold even when the model ignores an instruction.
Rule 3: Source Every Answer
Configure your AI to always reference the specific document it’s drawing from. When the AI says “our pricing for CLT panels in the EU market is X,” it should also say where that information came from and when the source was last updated.
This serves two purposes: users can verify accuracy, and you can spot when the AI is pulling from outdated documents.
Rule 4: Handle “I Don’t Know” Gracefully
The most dangerous AI behavior is confident hallucination — making up plausible-sounding answers when the knowledge base doesn’t contain the information.
Your system prompt should include explicit instructions: if you don’t find the answer in the knowledge base, say so. Don’t guess. Suggest who in the organization might know the answer. This is the single most important governance rule.
Rule 5: Log and Audit Usage
Use bounded usage records to investigate knowledge gaps and access failures. Specify the purpose, necessary fields, who can review them, and the retention schedule; avoid collecting sensitive prompt content merely because it is available.
Verify the logging and export functions available in the current product configuration. If you add an integration, restrict access to its records and test its failure behavior before relying on it for review.
Rule 6: Establish Update Cadence
Knowledge bases decay. Pricing changes, processes evolve, team members rotate. An AI assistant giving answers based on six-month-old data is worse than no AI at all — because users trust the answer.
Define who owns each document, how often each category gets reviewed (quarterly for strategy, monthly for pricing, weekly for active project data), and what happens when a document is flagged as outdated.
Rule 7: Define AI Personality and Tone
This sounds soft but matters for adoption. If the AI responds in a way that doesn’t match your company culture, people won’t use it. Configure the tone (professional but not stiff), the language (match what your team actually uses), the level of detail (brief answers with option to go deeper), and how it handles ambiguity (ask for clarification vs. give best guess).
The system prompt should include examples of ideal responses for common question types.
Putting It Together
A complete AI governance document typically covers role definitions and access levels, explicit information boundaries (what not to share), response format rules (sourcing, length, tone), escalation paths (when to redirect to a human), update and maintenance schedule, and incident handling (what to do when the AI gives wrong information).
This document lives in your knowledge base and is referenced in every system prompt. It’s not a one-time setup — it evolves as you learn how your team actually uses the AI.
The ROI of Governance
Evaluate governance through observed behavior: access tests, incident reviews, source quality, and feedback from the people using the assistant. Clear rules can support these outcomes, but they do not guarantee adoption, accuracy, or the absence of leaks.
Estimate setup from the permissions, data sources, tests, and review owners your deployment needs. Record remaining gaps before release rather than relying on a fixed implementation-duration estimate.
Governance rules only work when your knowledge base is well-structured. See How to Structure Company Knowledge for AI for the foundation. And if you’re still assessing whether you need a KB, check 5 Signs Your Company Needs an AI Knowledge Base.
Need help setting up AI governance? Governance rules are part of our Full AI Transformation and AI Assistant Setup services. Book a discovery call to discuss your needs.