Private knowledge is not a prompt

The fastest way to make an agent "know" your company is to paste documents into its system prompt. It works beautifully in the demo. Then a policy changes on a Tuesday, and on Wednesday the agent is still confidently quoting Monday's version, because nobody remembered the prompt contained a copy.

Private knowledge is living data. It changes, it has owners, it has access rules, and parts of it are wrong. Grounding an agent in that knowledge is a retrieval systems problem, and it deserves the same engineering as any other data pipeline.

An illustrative failure

Consider a hypothetical HR assistant built for a mid-sized company. The team loads the employee handbook into the system prompt and adds a search tool over the shared drive for everything else.

Three months later, three problems have surfaced. The assistant cites an outdated parental-leave policy, because the handbook in the prompt was never refreshed. It shows a draft compensation memo to an employee who should not see it, because the search index was built with an administrator's permissions. And it answers some questions by blending two contradictory documents, because both were retrieved and nothing marked which one was authoritative.

None of these is a model problem. All three are retrieval problems.

Five properties of trustworthy retrieval

1. Permissions travel with the user. Filter results by the requesting user's access, not the index builder's. Where source systems allow it, query them with the user's own credentials. Where they do not, mirror access control lists into the index and test them.

2. Freshness is designed, not hoped for. Every source has an expected update pattern, and the index should match it (see the table below).

3. Authority is explicit. Tag documents with a status (draft, approved, superseded) and an owner. Rank approved sources above drafts, and drop superseded versions entirely.

4. Claims carry citations. Factual answers should cite the passage they rely on, with a link the user can open. Citations make errors visible and correctable.

5. Retrieved text is untrusted. A document can carry instructions as easily as information. The OWASP Top 10 for Agentic Applications lists memory and context poisoning as a distinct risk. Mark retrieved content as data in the context, and never let it alter the agent's instructions or tool permissions.

Matching freshness to the source

The last row deserves emphasis. When a system of record exposes an API, a structured tool call beats retrieval over a copied document every time. An agent should look up today's price, not remember last quarter's spreadsheet.

Fitting retrieval into context

Anthropic's Effective context engineering for AI agents recommends retrieving information just in time: keep lightweight references such as file paths or IDs, and load the content only when it is needed, rather than front-loading everything. For knowledge work, that means a small number of highly relevant, deduplicated passages per question, not the top twenty chunks by similarity.

MCP resources are a tidy way to expose reference material such as a current policy, so the host fetches it on demand instead of every prompt carrying its own stale copy.

Retrieval with write access

Agents that both retrieve and act need extra care. If an agent reads a document and then sends an email or updates a record, that document has indirectly influenced an action. Keep approval gates on writes, especially when unreviewed content was part of the context that produced them.

Metrics that reveal real problems

Thumbs-up ratings are a weak signal for retrieval quality. Better ones:

• Stale-citation rate: how often answers cite a superseded or outdated source. This is the single most revealing number.
• Retrieval recall on a test set: for known questions, did the right passage appear among the results?
• Unsupported-claim rate: in sampled answers, how often the cited passage does not support the claim.
• Permission test pass rate: for test users with different access levels, does each see only what they should?

Build a small evaluation set of questions with known correct sources, run it whenever the indexing pipeline changes, and treat any permissions failure as a hard stop. Knowledge that cannot be trusted to be current and correctly scoped is worse than none at all, because the agent delivers it with confidence.

Sources cited

• Anthropic, Effective context engineering for AI agents (published September 29, 2025)
• OWASP GenAI Security Project, Top 10 for Agentic Applications 2026 (released December 9, 2025)