Hiring the world’s most articulate receptionist won’t help much if nobody gives them the appointment book. Giving them every filing-cabinet key on the first morning is an interesting alternative, although perhaps not one to put in the employee handbook.
Business AI has a similar problem. A model can explain your industry convincingly while knowing nothing about the delivery promise a salesperson made yesterday.
OpenAI’s November 2023 developer announcements make connecting those two worlds easier.1 The Assistants API, introduced in beta, combines models with capabilities including retrieval and function calling. That creates practical opportunities. It does not decide which information an assistant should see or which actions it should be allowed to take.
Here’s how I’d approach a first internal assistant without accidentally promoting it to managing director.
Give the assistant one useful job
Start with a question somebody actually needs answered. For a hypothetical equipment-rental business, that might be finding the approved cancellation policy for a particular type of booking.
That is narrow enough to test. It also forces three important decisions into the open.
Choose the information that can answer it
General model knowledge is different from operating information. An approved policy document can supply context for an answer. A current booking status may need a live request to the booking system.
Treat those sources differently. A policy can remain valid for months. Availability may change while someone is reading the response.
Retrieval means finding relevant information and supplying it to the model. Embeddings, numerical representations of content, can help find related material even when the wording differs. They are useful search tools, not little certificates of truth attached to every paragraph.
Identify approved documents, their owners and how obsolete versions will be removed. Three contradictory policies won’t become one dependable policy just because the answer arrives in excellent English.
We build AI agents with clear jobs and sensible limits. See how.
Apply permissions before supplying the context
If one employee cannot view another customer’s contract in the main system, the assistant should respect the same boundary.
The application must enforce that restriction before information reaches the model. Telling the assistant to be discreet is reasonable guidance. It is not the same thing as preventing access.
Test with users who have different permissions and questions that cross those boundaries. Include a request that sounds harmless but would reveal restricted information through a summary.
An assistant that refuses to quote a confidential document but happily explains everything in it has interpreted the dress code rather creatively.
Keep looking and changing separate
Function calling lets a model propose structured arguments for a function the application provides. The application still needs to validate those arguments, check authority and decide whether the action may execute.
Looking up a booking date should be a separate capability from changing it. The second can affect staffing, equipment availability and a customer’s plans.
For an initial version, a read-only task is often easier to evaluate. Add actions when you can define their limits, confirm consequential changes and record what happened. A good answer to a policy question is not evidence that autonomous refunds will go well.
Test the awkward questions before widening access
Simon Willison’s prompt-injection work highlights a further complication: text an assistant reads can contain instructions trying to redirect it.3 A customer message or retrieved page must not gain authority simply because it entered the conversation.
Pairs well with Before giving AI access to the CRM, draw the permission boxes.
Keep tools limited and enforce their rules outside the model. A stronger prompt can help describe the job, but it cannot replace permission checks and input validation.
Prepare a small evaluation set that includes:
- Questions answered directly by the approved material.
- Questions where the wording differs from the source.
- Questions with missing or contradictory information.
- Requests for information the user cannot access.
- Retrieved text that tries to instruct the assistant to do something else.
Check the evidence as well as the answer. Did it find the right policy? Can the employee open the supporting source? Does it admit when the answer isn’t available?
That last behavior matters. A confident invention can be harder to catch than a visible failure, particularly when the invention sounds like the policy everyone vaguely remembers.
Measure whether the assistant helps people complete the defined task correctly. Response speed and pleasant phrasing matter, but they come after that.
A first version that reliably locates the right information, shows its source and respects access boundaries is a worthwhile result. Pretty cool, actually. It doesn’t need to pretend it understands the entire company.
Give it the appointment book it needs. Leave the cabinet keys with the people responsible for them.