An assistant is only as clean as the material it reads. PDFs hide tables, scans lose footnotes, folders hold drafts, and old policies sit beside current versions. We look at that mess directly instead of pretending it will sort itself out. Getting documents ready usually means reading scanned files, tagging each one with its owner, date and version, removing duplicates and applying access rules.
Sources are part of the trust. A staff assistant may only need a file name and a paragraph. One that faces clients may need a title, a date, a version and a short note on why that source was used. If your documents change often, the update path is built in: an overnight refresh, a trigger from your document store, an approval queue, or a staged release where new documents are tested before the public assistant sees them.
For personal data we document where it flows, how long it is kept, who can reach it and how it is deleted. We check governance before architecture too. The ICO guidance on AI and data protection, the UK government introduction to AI assurance and the OWASP Top 10 for LLM Applications point to the same need: know what data is used, test the system, document the risk and keep people accountable. Each month we go through the questions it could not answer, the weak sources and the effect on your team. An assistant improves when real use is reviewed. It decays when nobody looks.