Governed knowledge Q&A is the pattern for policies, procedures, contracts, precedents and case files that people spend hours finding and re-finding. Retrieval respects who is allowed to see what, every answer cites its source, and nothing leaves your boundary.
The policy is on the intranet, the exception to it is in an email from 2023, the procedure is a PDF on a shared drive, and the precedent is in a colleague's memory. Search finds documents, not answers, and the person who knows is the bottleneck for everyone else.
Board papers, HR files, deal terms and regulator correspondence carry access rules for good reasons. A generic chatbot that has read everything will happily summarise a restricted document into an unrestricted answer. The permission model has to survive retrieval, not sit beside it.
In a regulated operation, an answer that cannot point to its source is an opinion. Staff will not act on it, auditors will not accept it, and when it is wrong nobody can trace why. Fluency is not the problem; provenance is.
Read, decide, act, operate. Human approval gates are named at the steps where money moves, records change or a customer is affected.
Repositories are connected through their own access controls: SharePoint, document management, case systems, mail archives where allowed. Each chunk of content is indexed with the identity and group permissions of its source, in Arabic and English, and re-indexed when the source or its permissions change.
A question is answered only from content the asker is permitted to see, filtered before the model reads anything. The model composes an answer from those passages and must cite them; when the sources disagree or the question is out of scope, it says so rather than filling the gap.
Approval gate: answers on designated topics, such as policy interpretation or anything touching an individual, are drafts for a named owner to confirm before they are shown as authoritative.
The same layer answers in the tools people already use: a panel in the case system, a channel in Teams, a field in the CRM. Answers link to the source document at the paragraph, so the next step is one click, not another search.
Every question, the passages retrieved, the answer given and who asked are logged. Unanswerable questions become a list of knowledge gaps for the content owners. Ratings from staff tune retrieval; nothing tunes the permissions except the source systems.
Approval gate: adding a repository, or widening the audience for one, is a recorded decision by its data owner, not a configuration change.
A financial institution's compliance and operations teams, anonymised. Outcomes are described, not quantified; the diagnostic measures them on your own repositories.
A relationship manager needs to know whether a corporate client's structure requires enhanced due diligence. The policy is 90 pages, the last circular changed the threshold, and the one person who knows is in a meeting. The manager asks a colleague, gets a partial answer, and either over-applies the rule and delays the client or under-applies it and creates an audit finding.
The manager asks the question in the CRM. The answer quotes the current policy paragraph and the circular that amended it, states the threshold, and notes that the case looks like it falls above it. Both sources are one click away. Compliance sees the question in the log, confirms the interpretation once, and the confirmed answer serves the next fifty people who ask.
What changes: questions answered from the current source with the citation attached, specialists consulted for judgement rather than lookup, and a live list of the questions your documentation cannot answer. We do not publish a straight-through figure for this pattern; the diagnostic measures it against your own question volume.
Four or more of these and the diagnostic will almost certainly find a wedge here. Fewer, and we will tell you so.
Permissions are enforced before retrieval, from the source system's own access model, so no answer can contain what the asker could not open. Every answer is cited and every question is logged with its retrieved passages, which is the audit trail a supervisor asks for. Content and models stay in the jurisdiction you specify, on sovereign cloud or on-premise where PDPL, SAMA or CBUAE require it.
Cases from the delivery record are pre-AI enterprise work and are labelled as such. They show where we have already run the systems this pattern has to live inside.
A comprehensive digital transformation of core banking operations on Temenos T24, repositioning the bank as a digital-first institution while daily operations kept running.
A twelve-month transformation of a UAE audit firm: portfolio rationalisation, pricing discipline, a modern CRM and a Microsoft estate migration.
Triway is its own first client. We replaced ten spreadsheets and a string of abandoned CRMs with one we built in-house, where an agent researches every new company and contact and a person approves anything it cannot verify. It gives each sales rep about five hours a week back.
Start with the two-week diagnostic. We map the processes where this pattern would compound, score them honestly, and leave you with a plan worth keeping, whoever you choose to build with.
Not ready to book? See where AI would pay off first: twelve questions, three minutes.
