5.3Connecting your business data
The essentials in 30 seconds
- Knowledge makes the agent: connected to YOUR sources (SharePoint, websites), it answers about your information, not generalities.
- Scope + freshness: few relevant, up-to-date sources — an outdated corpus makes it answer wrongly and confidently.
- Permissions: the agent must never bypass access control — everyone only sees what they are already entitled to.
Running case — Hicham connects his agent to SharePoint
Hicham's leave agent answers well — but only on one isolated guide. Hicham, an administrative assistant in Algiers, connects it to the internal policies SharePoint site: he removes the old versions, keeps only the documents in force, then checks with a limited-rights account that no restricted document surfaces. Sequel to case 5.2 — Hicham gives his agent its real value, without opening a breach.
Sequel to case 5.2 — Hicham moves from an isolated source to the business corpus, under access control.
1. Knowledge makes the agent
An agent is only as good as what it knows. Connecting its business data gives it its real value: SharePoint/OneDrive documents, public websites, sometimes business systems via connectors. The agent then answers about YOUR information, not generalities. Hicham connects the internal policies site: his agent becomes the expert of the department's corpus.
The most common source: a SharePoint folder or a specific site. 'Answer based on this internal policies site' — the agent becomes the expert of that corpus, always up to date if the corpus is.
2. Scope and freshness
Two decisive settings. The scope: only connect relevant, trustworthy sources — too many sources, or contradictory ones, degrade the answers. Freshness: an agent connected to outdated documents answers falsely and confidently. Hicham removes the old versions of the leave guide: a single version in force.
Hence a discipline: curating knowledge. You pick authoritative sources, remove obsolete versions, maintain the corpus. An agent's knowledge is a garden to tend, not a storeroom you fill and forget.
3. Permissions: the agent inherits the scope
A major security guardrail: permissions. An agent connected to SharePoint must respect access rights — be careful not to expose, via the agent, documents the user has no right to see. Poorly configured, an agent becomes a data leak. Hicham has a colleague with limited rights test it: nothing restricted must surface.
Principle: the agent must not bypass access control. Design the connections so that everyone only sees, through the agent, what they are already entitled to. Security beats convenience — and when in doubt, have the IT department approve it.
🔎 Concrete example — Hicham makes his agent the expert on internal policies
Connect, curate, lock down: the complete move.
1. Connect the 'Internal policies' SharePoint site as a knowledge source.
2. Remove the old versions; keep only the documents in force.
3. Check that the agent respects permissions: an employee only sees what they are entitled to.Reading: an agent that answers about YOUR up-to-date policies.
Lesson: test with a limited-rights account to check that no restricted document leaks.
Section vocabulary
- Connected business data
- The organization's sources connected to the agent: SharePoint, websites, systems.
Simple example: Hicham connects the internal policies site.
What it is not: general statements with no grounding in your documents.
Reflex: does the agent answer about OUR information?
- Source scope
- The choice to connect only relevant, trustworthy sources.
Simple example: Hicham keeps only the site of the policies in force.
What it is not: connecting everything, including drafts and duplicates.
Reflex: is each source really necessary?
- Freshness
- The requirement of an up-to-date corpus: outdated content makes the agent answer wrongly and confidently.
Simple example: Hicham removes the old versions of the leave guide.
What it is not: a storeroom filled once then forgotten.
Reflex: who removes obsolete versions, and when?
- Curation
- Maintaining the corpus: picking, cleaning and keeping the authoritative sources.
Simple example: Hicham curates the corpus like a garden, every quarter.
What it is not: piling up documents with no sorting.
Reflex: is my corpus a garden or an attic?
- Inherited permissions
- The agent's obligation to respect existing access rights.
Simple example: Hicham's limited-rights colleague sees nothing restricted.
What it is not: an agent that exposes to everyone what few may see.
Reflex: did I test with a limited account?
In practice — Connecting and securing an agent's knowledge
- Pick one or two authoritative sources (an internal policies SharePoint site, for example).
- Curate the corpus: remove obsolete versions, keep only the documents in force.
- Connect these sources to the agent and test the relevance of the answers.
- Check the permissions with a limited-rights account: no restricted document must leak via the agent.
Ready-to-say script — asking for access approval
'I am connecting our agent to the internal policies SharePoint site: I only keep the documents in force and I check with a limited-rights account that nothing restricted surfaces. Before expanding to other sources, I suggest we have the scope and the authorizations approved by the IT department.'
To say to your manager to get sources and permissions approved before expanding the corpus.
Copy-paste template — source connection sheet
SOURCE SHEET — one per connected source
SOURCE: ___ (SharePoint site / folder / website)
AUTHORITY: who guarantees this content? ___ · up to date as of ___?
CURATION: obsolete versions removed? YES / NO · duplicates? ___
PERMISSIONS: who is entitled? ___ · limited-account test on ___: OK / KO
REVIEW: next check on ___ · owner ___Solo / small budget
Hicham alone: a single authoritative source, curated by hand — no need to connect the whole SharePoint.
Small business / small team
One well-organized shared folder as the single source: the whole team knows where what the agent reads lives.
SME in Algiers
Hicham agrees with the IT department in Algiers on the list of connectable sites and the limited-account test.
Team getting started
Pair up: one curates the corpus, the other blind-tests the answers and the permissions.
✓ Best practices
- Curate sources like a garden: few sources, relevant, up to date, authoritative.
- Always test with a limited-rights account: it is the only way to check that no data leaks.
- Mercilessly remove obsolete versions: an outdated document makes the agent answer wrongly and confidently.
✗ Common pitfalls
- Connecting too many sources or contradictory ones: the answers degrade.
- Forgetting freshness: an outdated corpus produces answers that are wrong and confident.
- Neglecting permissions: a poorly configured agent exposes restricted documents — a data leak.
Key takeaways
- Connecting business data (SharePoint, websites, systems) gives the agent its real value.
- Two decisive settings: scope (relevant sources) and freshness (up-to-date sources).
- An agent's knowledge is a garden to tend, not a storeroom you fill and forget.
- Major guardrail: the agent respects permissions and never exposes an unauthorized document.
48h challenge — apply tomorrow
Fill in the source sheet for 1 real source (template above) and test it with a limited-rights account: what does it see?
- I can explain scope and freshness in one sentence.
- My source is curated and documented (sheet filled in).
- The limited-rights test proves that no data leaks.
Frequently asked questions
Which sources can you connect to an agent?
SharePoint/OneDrive documents, public websites, and depending on the connectors, business systems. Best to start with one authoritative, up-to-date source.
Can an agent expose confidential documents?
If poorly configured, yes — hence the importance of permissions. Well designed, the agent respects access rights: everyone only sees through it what they are already entitled to.
What major risk threatens a poorly configured agent connected to SharePoint?