Search Your Company's Knowledge With AI: Copilot or Gemini, a Search Product Such as Glean, or Build Your Own

Somebody in your company asks where the latest refund policy is. The answer sits in three places: a wiki page, a ticket thread and a chat message from last spring. Knowledge search with AI reads all of those sources and replies with one answer and links to where it came from. You have three routes. You can use your office suite's assistant, which may need its own licence, buy an enterprise search product, or build a system on your own data. The right route depends mostly on how many tools hold your knowledge and how tidy your access rights are.

When is plain search enough, and when is it not?

Plain search is enough when people know which tool to open and the page has a clear title. A wiki search box or a shared-drive search does that job well and costs nothing extra.

It stops being enough in three cases. The answer is spread over several tools. The question uses words that no document uses. Or the person wants a single short answer. Before you buy anything, ask ten colleagues for their last question that took more than ten minutes to answer. If most point to one tool, fix that tool's search first.

How does retrieval work, and how does an answer get its sources?

Retrieval means finding the passages most likely to hold the answer before any answer is written. Software reads your documents and cuts them into passages. It stores them in an index, a lookup structure built in advance so that a search does not read every file each time. When someone asks a question, the system fetches the best-matching passages. Then a large language model, the kind of program behind ChatGPT, writes a reply from them.

RAG, short for retrieval-augmented generation, is the name for these steps together. AWS opens its explanation with “Retrieval-Augmented Generation (RAG) is the process of optimizing the output of a large language model”, and adds “The output can include citations or references to sources.”

To match meaning as well as exact words, many systems turn each passage into an embedding. An embedding is a list of numbers that stands for what the text means, so that passages about similar things sit close together. OpenAI describes embeddings as a way to “measure the relatedness of text strings”.

The sources beside an answer normally come from the passages handed to the model. A link shows where the system says the text came from. It does not prove the model read it correctly, so open the links on a sample of answers.

What does the assistant in our office suite cover, and where does it stop?

A connector is a piece of software that reads one outside tool, such as Confluence or a CRM, and passes its content to the search system. Microsoft says it offers “over 100 prebuilt connectors for popular services”. On the Google side, a separate product does this job, apart from the Gemini assistant inside Workspace apps. Google says “Gemini Enterprise is an intranet search, AI assistant, and agentic platform” with “prebuilt connectors for commonly-used third-party applications like Confluence, Jira, Microsoft SharePoint, and ServiceNow.”

The limits are practical. A suite assistant reads best what already lives in the suite. A tool without a ready connector needs a custom one. Microsoft's page says “Custom connectors offer flexibility but require maintenance.” Ranking, answer style and the range of models are the vendor's choices, so you can adjust them less than in a system you build.

What does a dedicated search product add, and what do we give up?

Glean, Elastic, Coveo, Guru and Atlassian Rovo are examples of products used to search across many tools. Atlassian says “Rovo Search allows you to search across multiple tools at once without context-switching.” What you gain varies, so check three things. How many of your tools have a ready connector that the vendor maintains? How are results ranked, and does the product use who works on what, such as the author of a page, as a signal? Can you see why a result ranked first?

What you give up is simplicity. A search product is usually another contract and another admin console. If the vendor hosts it and indexes your content, that vendor also holds a searchable copy. That copy needs its own review of region, retention and vendor access.

What does building your own consist of, and who runs it afterwards?

There are five parts. Connectors read each source with its permission data. An ingestion job cuts documents into passages and refreshes them. An index supports keyword and embedding search. An answer step passes the best passages to a model and tells it to cite them. A chat screen or an add-in, with logs and an admin view, completes the set. Elastic's documentation says “Document level security restricts the documents that users have read access to”. On some subscription levels, Elastic's own connectors sync those permissions for sources such as Confluence and SharePoint Online. For other sources, you write the mapping yourself.

The work after launch is the larger part. Someone must repair connectors when a source changes, rerun ingestion, watch the model bill, keep the test questions current and explain why the assistant said what it said. Name those people before you start.

How do access rights carry over, and what is the oversharing problem?

Most sources keep a record of who may open each item, often called an access control list, or ACL. A connector that copies content into an index should copy that record too. For such connectors, Microsoft says “Each item includes content, metadata (like title and URL), and an access control list (ACL) that enforces permissions.” Glean says “If a user can't open a document in the source system, that document can't be used as context, returned as a search result, or surfaced as a citation.”

The copy is only as good as each connector. SharePoint and Google Drive have folders, groups and sharing links. Confluence has space and page restrictions. Slack has private channels and direct messages. A CRM has roles and record owners. For each source, ask how the vendor reads these rules, how fast a change arrives, and what happens when a rule cannot be read. The safe answer to the last question is to hide the item.

Oversharing is the older problem that an assistant exposes. Suppose a payroll folder was shared with the whole company years ago. Search never surfaced it because nobody looked, and an assistant can. Microsoft states “Overshared or poorly governed content can affect Copilot results and increase risk.” Its SharePoint site permissions report, part of SharePoint Advanced Management, shows which sites grant access to “Everyone except external users”, a group that “automatically includes all internal users but excludes any external guests”. Review the widest-access sites with their owners before launch, and start the pilot with a narrow set of sources.

What happens with stale, duplicate and conflicting documents?

The assistant may not be able to tell which of two policies is current. It may quote both, or quote the old one with confidence. Name an owner for each source, retire what is out of date, and keep one source of truth per topic. Ask the assistant to show the date and author of each source and to say when sources disagree.

Freshness has a second side: how quickly a change reaches the index. Microsoft says “New documents that are added to SharePoint Online sites that are accessible, via site inheritance, by two or more users are indexed daily.” For a document already indexed, it says “the changes are immediately indexed.” Ask every vendor for both delays in writing.

How do we test answer quality on our own questions before launch?

Collect real questions from staff, each with the correct answer and the document it should come from. Run the same set on every candidate. Score four things: the right document among the sources, a correct answer, an honest admission when no document helps, and respect for access rights.

The access test needs two logins. Ask a question whose answer sits in a folder that only one person may open. The other person must get no trace of it, not even a source title. Repeat the set after every change. Our article on pass marks, linked above, covers thresholds.

What does the AI assistant log, and who can see what people asked?

Questions can be sensitive, such as one about a colleague's disciplinary process. Microsoft says its audit records “contain details about which user interacted with Copilot, when the interaction took place, and where it occurred”. Separately, it says the data it stores “includes the user's prompt and Copilot's response”, and adds “To view and manage this stored data, admins can use Content search or Microsoft Purview.” For every route, ask who can read the text of questions, for what reason and for how long.

What do GDPR roles, region, retention and erasure mean for the index?

GDPR is the EU data protection law. When a vendor handles personal data for you, you are usually the controller, which decides why and how data is used. The vendor is the processor, which acts for you. The European Data Protection Board's guidelines say “The processor shall not go beyond what is instructed by the controller.” They add “The instructions issued by the controller must be documented.” A processor may not engage another one “without prior specific or general written authorisation of the controller”. Have your own counsel read each contract.

Ask each vendor for the region directly. Microsoft says “EU traffic stays within the EU Data Boundary while worldwide traffic can be sent to the EU and other countries or regions for LLM processing.” A note on the same page adds “Models provided by Anthropic as a subprocessor are currently excluded from the EU Data Boundary.” Microsoft says those models are disabled by default for customers within that boundary, so check the admin setting. For its index, it says “For customers within the European Union Data Boundary (EUDB), the index is stored in an EU/EFTA based datacenter.” Microsoft also says “Prompts, responses, and data accessed through Microsoft Graph aren't used to train foundation LLMs”.

The index is a copy of your documents, so personal data in a document is also in the index and often in the logs. The Board's guide for small businesses says “Always answer a data subject request within one month.” It allows “two further months” for a complex request, if the person is told within the first month. Ask how long a deleted document takes to leave the index, whether backups and logs keep its text, and how one person's questions can be removed.

How does per-seat pricing differ from usage pricing?

Per-seat pricing charges a fixed amount for each named user, whether or not that person searches. Usage pricing charges for what the system does, such as the text it processes. Vendors use one or the other or a mix. Ask for the current price in writing, with minimum seat counts, add-ons and connector fees, and ask who needs a licence.

As one example of usage pricing, OpenAI's pricing page lists its text-embedding-3-small model at 0.02 dollars per million tokens, and text-embedding-3-large at 0.13 dollars. A token is a small piece of text that providers count and bill. The cost of storing the index, running the model and paying the people comes on top. Take an invented archive of 50,000 documents of about 2,000 tokens each, which is 100 million tokens. Turning it into embeddings once costs 2 dollars with the small model and 13 dollars with the large one. The archive size is an assumption, and list prices may change.

What does lock-in look like, and what should we keep so we can leave?

Lock-in sits where your effort went: connectors set up in one vendor's console, ranking rules in its format, permission mappings only it holds. The index can be rebuilt from your sources, so it matters least. Keep your test questions with expected answers, a written map of how permissions are read, the instructions given to the model and any custom connector code. Ask for a log export. Agree export and deletion terms in the contract.

When is building your own knowledge search justified?

Building is justified when search is part of the product you sell, because your clients are then the users and no staff licence covers them. It is also justified when a data rule excludes every product, including those that run in your own cloud. For staff search alone it is hard to justify, because you would take on connectors, access control, logs and on-call duty.

What should we ask a vendor, or a firm that would build it?

For a vendor or suite provider:

• Which of our sources have ready connectors, and who maintains them?
• How do you read permissions from each source, and what happens when a rule cannot be read?
• How long does a change or a deletion take to reach the index?
• Where are the index, the questions and the logs processed, and who can read the questions?
• What does a month of our real usage cost, and what can we export if we leave?

For a firm that would build it:

• Which parts will you write, and which will you take from existing products?
• Will it run in our cloud account, and who holds the keys?
• How will you test answers and access rights, and who on our side signs off?
• Who runs it after launch, and what does that cost each month?

Where does amBrain fit?

amBrain publishes this blog. On its own product, it says: “Our own product, aigo, runs on AI agents that research, write, check and measure from one shared memory of company facts. A person approves everything that goes out.”

This article is not a case study and describes no client work. It does not claim that amBrain has built a knowledge search system for any client. The line above is about amBrain's own product, and the examples are general.

The companies, products and public bodies named here are cited from their published pages, read on 11 November 2026. The article claims no relationship between amBrain and any of them and gives no amBrain prices or timelines.

amBrain has been building software since 2019. On how it works with clients, it says: “Three formats: full delivery, a dedicated team, or engineers embedded in your team.” Its line on ownership is “The client keeps full ownership of the product and the code, except our reusable components.” Ask for the list of those components by name before you sign.

If amBrain is on your shortlist, ask it the same questions as any other firm.