AI knowledge bases are operating infrastructure, not “second brains”

What the paper develops

The answer passed the demo

Imagine an executive sponsor reviewing an AI assistant before people rely on it for operating work. The answer appears quickly, reads well, and cites a policy page that looks authoritative. During the review, the team discovers that the page was replaced six months ago. The retrieval worked. The model followed the source. The answer was still wrong.

The sponsor must decide whether that knowledge base is reliable enough for operating use. A clean interface and a capable model can make the system look ready while the source underneath it remains stale, contradictory, or unowned. Generative AI makes the defect harder to spot because it turns weak source material into fluent, plausible prose.

The personal-notebook frame examined here assumes that the writer and reader are usually the same. The owner remembers what changed, what a shorthand phrase means, and which copy to ignore. Enterprise reuse removes that private context. Many people and systems act on content they did not create and cannot quietly correct.

What retrieval proves

Research on data quality in retrieval-augmented generation found that problems concentrate in source and ingestion stages, then propagate through retrieval and generation. The study is qualitative, based on practitioner interviews, so it does not measure the output effect of every defect. It does explain why a source problem can survive a technically successful retrieval.

Teams often work at the visible layer when an answer disappoints. They adjust the prompt, tune retrieval, or compare models. Those actions may improve how the system finds and presents content. They carry no organizational authority to make an old policy current or decide which of two conflicting pages the business accepts.

The stakes grow with use. Plausible errors spread through decisions before anyone knows which source caused them. Confidence then falls even in answers supported by sound material. Investigation slows because an unowned source gives the reviewer no clear person, history, or validation record to inspect.

The missing approval

The missing decision sits before retrieval: a named source owner must confirm that the business still accepts the document as current. Five controls make that approval executable. The owner rejects admission while a material conflict remains unresolved or any required control lacks an answer.

Ownership identifies who can approve changes and act on failure. Quality control checks the dimensions that matter in the domain. Update discipline defines the event or cadence that forces review. Access governance limits reads and writes. Lifecycle management distinguishes validated, current, deprecated, and removed content.

Provenance connects the approved source to the answer a person sees. A useful record identifies the source, owner, last review, approval basis, and replacement history. Without that path, a reviewer may like an answer but cannot establish whether its source was approved, copied, inferred, or carried forward after its context changed.

Start where a wrong answer matters most

The sponsor does not need to clean the entire knowledge estate before acting. Choose one domain where a confidently wrong answer could change an approval, access decision, procedure, or external commitment. Define its trusted retrieval set and assign the owner who approves admission. Record the quality standard, refresh trigger, write permissions, provenance, and retirement events. Then test real questions and trace each answer back to a current source.

This bounded start produces evidence for the next decision: whether conflicts surface, whether reviewers can reconstruct an answer, and whether the owner responds when content changes. Expansion can follow observed control rather than a broad promise that every document is clean.

Source governance addresses one necessary layer of reliability. Retrieval, evaluation, and generation design still matter. The five controls do not make every answer correct, and the same control depth will not fit every domain. They establish the organizational facts the technical layer cannot decide: which source the business accepts, who may change it, and when it expires.

The approval move is concrete. Start with the highest-consequence domain and rely on its knowledge only after the named owner has admitted each source through the gate. That is how a document collection becomes operating infrastructure an organization can inspect and govern.