Enterprise knowledge management (KM): knowledge people and AI can use

What should an enterprise KM system solve first?

An enterprise knowledge-management system should help people find usable information, identify its source and valid version, understand its limits and request corrections. It is not simply a collection of documents uploaded to a chatbot. Without ownership, versions and access boundaries, faster retrieval can spread incorrect information faster. AI is one possible access method. Begin with a frequent task such as service descriptions, internal procedure lookup or project handover. Identify who needs which answer and what happens if it is wrong. Existing documents and a clear index may be enough initially. Make finding, referencing, updating and handing over information work before adding semantic search or generated answers.

Scroll the diagram horizontally to read

Distinguish authoritative facts, methods, research and working memory

Not all knowledge has the same authority. Formal facts need confirmation and a valid version. Methods explain how to work. Research retains sources and uncertainty. Working memory records where a task stands. These can link without becoming interchangeable. Repeated citation does not automatically promote research into an approved company fact. Conversation summaries should not be the only task state because a change of tool or colleague can break continuity. Mark content type, status and responsibility. Candidate, valid, superseded and disputed are possible states, subject to existing organizational rules. Readers and systems need to know which material can support a formal answer. Preserve replaced material and its successor so historical decisions remain understandable.

What metadata does one knowledge item need?

A minimum record can include stable identifier, title, content type, source, version, status, owner, approval information, validity conditions, usage limits, relationships and review triggers. Keep the identifier stable while titles can change. Retain content in its designated source and let other views reference it rather than maintaining competing copies. Missing names or dates remain unknown; an AI should not fill them imaginatively. W3C’s PROV data model describes provenance through entities, activities, responsible agents, derivation and time.[S1] The KM fields proposed here are an implementation recommendation, not a declaration of full PROV conformance. Traceable origin also does not make content automatically true. Quality, confirmation and present applicability still matter.

Connect intake, confirmation, use and revision

Put new material into intake with its origin and permitted use. A content owner classifies it, resolves duplication or links related items, and the designated role confirms anything needing formal adoption. Confirmation produces a valid version. Users find and reference it through an index rather than editing a generated view. A revision records differences, reasons and affected uses, with temporary invalid or disputed status where appropriate. If service scope changes, identify website, proposal and internal references and check each update. A search index is a derivative that can be rebuilt from sources. Confirmation and historical records cannot be reconstructed by guesswork. This separation supports upgrades without rewriting company knowledge.

Enforce access beyond folder labels

Define who can read which material and perform which actions, including whether search, summaries and AI context preserve those restrictions. Indexing confidential text must not make it available to everyone. Revoked access or removed sources also requires handling indexes, caches and derived summaries. Keep private drafts and workspace information within explicit boundaries. Microsoft’s document-level access guidance addresses permissions from ingestion to query and distinguishes application security filters from preview identity-based features.[S2] The cited principle is that retrieval must respect document access, not that a particular feature is production-ready. Test different identities and revocation. A private label in the interface is not evidence that unauthorized access is blocked.

Make retrieval and citation inspectable

Build a retrieval test set from actual questions: exact names, synonyms, former names, cross-document questions and cases with no answer. Results should show title, validity, version and scope, with access to the original. If AI generates an answer, consequential claims should map to specific passages. Missing evidence, conflicting content or insufficient permission should produce an explicit inability to conclude. A complete-looking answer must not conceal missing information, and a list of related files is not enough to establish citation support. Check whether the cited passage supports the sentence, is current and includes relevant limits. Higher-risk work still needs human confirmation; adding AI does not confer decision-making authority.

Illustrative scenario: a new colleague checking the current promise

Imagine a new colleague preparing a proposal and finding an old presentation, a research draft and an approved service description. KM exposes status and version relationships so the approved description becomes the starting point for formal use. Research can explain context without becoming a customer promise. If an important capability is missing, propose an update rather than inserting a new claim independently. In a rehearsal, another colleague should find the same valid content and unresolved questions. Change a version and check whether old references remain identifiable. This is a knowledge-work design example, not a customer result. A local demonstration must distinguish demonstrated retrieval from unverified synchronization, access, backup and concurrent-writing capabilities.

How should a KM system be accepted and maintained?

Acceptance should cover finding a valid version, opening its source, insufficient access, conflicting information, replacement, correction and handover. Test persistence after restarting, and test conflicts and non-overwrite behavior for concurrent writing. A static specification is not runtime evidence. Track time to a usable answer, citation correctness, obsolete-content use, unresolved questions and update waiting. Define the task and denominator first: citation correctness concerns whether sampled claims are supported by valid sources, not the number of documents or conversations. Assign content ownership and review triggers, retaining history, failures and untested areas. Success means necessary knowledge can be used, corrected and handed over accurately within access limits, not simply accumulating more material.

Frequently asked questions: chatbots, memory and migration

Must KM include a chatbot? No. A clear index, readable source, relationships and search can solve many tasks. Consider generated answers after sources and evaluation are usable. Is an AI saying it remembered enough? Important decisions and state belong in readable, versioned records rather than one tool’s private memory. Test continuity instead of trusting a completion statement. Should every file move at once? Begin with a task and permitted material, preserve origin and rights, and resolve duplicates and versions incrementally. Migration, indexing and establishing authoritative knowledge are different jobs. Bulk upload does not establish governance.

Sources and evidence boundaries

1. S1 · PROV-DM: The PROV Data Model

   W3C · Accessed 2026-10-22

   Supports the cited principle; operational steps and illustrative scenarios are editorial recommendations rather than reported customer results.

2. S2 · Document-level access control in Azure AI Search

   Microsoft Learn · Accessed 2026-10-22

   Supports the cited principle; operational steps and illustrative scenarios are editorial recommendations rather than reported customer results.