An AI assistant can answer in seconds. The longer part of the implementation is deciding what it should answer from. SharePoint permissions tell AI what a user may access. They do not tell it which policy is current, which process is approved or why three pages give three different answers. That distinction matters. An old PDF can be accessible, searchable and technically valid and still be the worst possible source.
10 SharePoint Pages AI Should Trust and 10 It Would Not
| AI should trust | AI should not trust |
| 1. An approved HR policy with an owner and review date | FINAL_v8_updated sitting beside five earlier versions |
| 2. A current IT support procedure | Instructions for a system replaced two years ago |
| 3. An official process page with clear steps and exceptions | A process page with no owner |
| 4. A controlled company glossary | Separate departmental glossaries with conflicting definitions |
| 5. An FAQ built from real employee questions | An FAQ written once for an intranet launch |
| 6. A maintained onboarding page | A regional copy with no country or audience information |
| 7. Current instructions for an internal system | A draft that became searchable |
| 8. Approved product or service documentation | Roadmap content presented as released functionality |
| 9. Controlled compliance guidance | A news post treated as permanent guidance |
| 10. Temporary guidance with an expiry date | Two authoritative-looking pages that contradict each other |
The categories look obvious in a table. They are much harder to separate inside a real SharePoint environment.
Old PDFs, missing owners and too many “final” versions: what we find during SharePoint AI implementations
Some findings are easy to spot. Others look perfectly trustworthy until the AI starts retrieving them. Here are five situations we regularly investigate before approving SharePoint content as an AI source.
1. The current page and the old PDF
HR updates a policy page, but the previous PDF remains in a document library. Both are searchable. Both use the same title. Only one is correct. Removing the old file from the navigation does not solve the problem. If AI can still retrieve it, it can still use it.
We check pages, attachments, exported PDFs and copies stored elsewhere. The goal is to identify one canonical source and exclude or clearly archive the rest.
2. Three correct answers for three different countries
A German travel policy, Spanish travel policy and company-wide policy can all be correct. The problem begins when the country, legal entity or audience is missing from the title and metadata. AI then has to infer which version applies.
We make that context explicit:
- country
- legal entity
- department
- employee group
- valid-from date
- valid-until date
The answer should not depend on AI guessing where the user works.
3. A polished page with no owner
Good formatting can make abandoned content look official. We check whether someone is responsible for the answer, not only whether the page looks trustworthy. If nobody can confirm the content, it should not become an authoritative AI source.
4. Permissions inherited over many years
AI may respect the permissions it receives and still make overshared information much easier to find. A user might technically have access to a site without knowing that it contains salary files, old management documents or sensitive project material. AI changes the effort required to discover that content.
Microsoft recommends reviewing oversharing and permissions when preparing SharePoint for Copilot. Restricted Content Discovery can temporarily limit the appearance of selected sites in organisation-wide search and Copilot while they are reviewed. It does not change the underlying permissions.
We therefore treat permissions and content quality as separate checks:
- Is the information correct?
- Should this user be able to receive it?
A source must pass both.
5. A page that answers only the easy version of the question
A process page may explain how to request software but say nothing about contractors, urgent requests or applications requiring a security review. AI will still try to answer those questions. We check the main instruction, exceptions and escalation route. When the source does not support an answer, the assistant should say so and point the employee to the responsible team.
That is safer than filling the gap with a plausible answer.
How we build a trusted SharePoint knowledge scope
We do not begin by indexing everything and cleaning it later. We start with a controlled set of useful content and expand it after testing.
1. Build a source inventory
We list the sites, libraries, folders, pages and files being considered. For each source, we record:
- business owner
- intended audience
- approval status
- last substantive review
- sensitivity
- duplicates
- regional or departmental scope
- whether it should be used for AI answers.
This often exposes the first problem: the organisation knows where its content is stored, but not which version employees should follow.
2. Classify every source
We use a practical classification:
- Trusted: approved and suitable for answers.
- Trusted with conditions: correct for a specific country, role or situation.
- Needs review: potentially useful but missing ownership, context or approval.
- Exclude: drafts, working content or unsuitable material.
- Archive: no longer current but retained for legal or historical reasons.
We do not classify an entire intranet as trusted because several pages are well maintained.
3. Define what “trusted” means
A page normally needs more than a recent modified date. We check six things:
- Authority: Is this the approved source?
- Ownership: Who is responsible for it?
- Freshness: Is the information still valid?
- Scope: Who and what does it apply to?
- Access: Are the permissions appropriate?
- Retrievability: Can AI extract the right answer without mixing unrelated sections?
A page that fails one check does not always need to be deleted. It may need an owner, clearer metadata, a smaller AI scope or a better structure.
4. Remove competing answers
We search for:
- duplicated pages
- old PDFs
- copied procedures
- news posts containing outdated instructions
- regional versions without labels
- archived content still included in search
- files with nearly identical names.
Tip: Don’t aim to make SharePoint perfectly clean. Try preventing AI from treating several competing sources as equally authoritative.
5. Make pages easier to retrieve
AI-ready content is usually easier for employees to read too. We prefer:
- one clear topic per page
- descriptive headings
- direct answers near the relevant heading
- numbered steps
- explicit exceptions
- meaningful link text
- a visible owner and review date
- links to the canonical source instead of copied instructions.
Microsoft similarly recommends centralising official knowledge, labelling it consistently and writing focused pages with clear headings for employee-facing AI agents.
6. Test with real questions
A demo question such as “What is our holiday policy?” is too easy. We build test questions from support tickets, SharePoint searches and the ways employees actually speak:
- Can I carry unused holiday into next year?
- Does this apply to employees in Spain?
- What happens if my manager is unavailable?
- Can a contractor request access?
- Which form do I use for urgent software approval?
For every question, we define:
- the expected answer
- the approved source
- which users should receive it
- when AI should ask for context
- when it should decline
- when it should direct the user to a person.
We also ask the same question in several ways. This helps reveal whether retrieval is stable or depends too heavily on one phrase.
7. Check the citation, not only the answer
A convincing answer can still come from the wrong source. During testing, we open the citation and check:
Does the page support the answer?
Is it the current version?
Does it apply to this user?
Did AI combine it with a conflicting page?
Is an important exception missing?
The answer is only as trustworthy as the source behind it.
8. Keep reviewing after launch
The knowledge scope changes whenever someone publishes a new page, uploads another policy copy or changes permissions. We therefore include ongoing checks for:
- new sources entering the scope
- pages approaching their review date
- unanswered questions
- conflicting citations
- permission changes
- frequently used sources
- answers users reject or escalate.
Microsoft provides agent-access reporting in the SharePoint admin center to help administrators understand how agents interact with SharePoint and OneDrive content.
AI governance is not a one-time cleanup before launch. It becomes part of maintaining SharePoint.
The question that changes the implementation
“Can AI access this page?” is a technical question.
“Do we want AI quoting this page to employees?”
is a business decision. That decision requires content owners, IT, security and the implementation team to agree on what counts as an authoritative answer. The bot is usually the easy part. Deciding what it is allowed to trust is where the real work begins.
