How could a team evaluate AI agents with protected business knowledge?
3 min readTest whether an intended recipient can read only the permitted collection and capabilities. Keep source access, collection publication, policy evaluation, and future execution under separate owners. Knowledge access does not grant an agent authority to spend.
Start with a narrow information need
Choose a question an assistant should answer using approved business knowledge, such as an explanation of a supplier requirement. Identify the source material and the person responsible for reviewing what may be shared. Use representative data that is permitted in the evaluation. Do not begin by granting broad access to every document and hoping the agent will select only the appropriate parts. A defined collection makes the access boundary easier to inspect.
Test the audience and the review process
Confirm what the intended recipient can discover and read, and test that an unintended recipient cannot obtain the same content. Include a question for which the collection has no approved answer. Decide how a clarification or revision returns to human review rather than becoming published authority automatically. These tests examine both access and content quality. They are different from testing whether the model can produce fluent language from whatever information it receives.
Keep knowledge separate from action
An agent may learn about a budget or a business policy without gaining permission to sign, contract, or settle anything. Demonstrate that boundary explicitly. If policy evaluation is included, label its result as a decision-only result and keep any future execution outside the pilot unless separately agreed. Retain the collection version, audience context, and evaluation references needed to explain the outcome. This lets the business assess useful assistance without confusing information access with operational authority.
What to do next
Combine a scoped knowledge-sharing test with a decision-only policy evaluation when relevant; retain denied cases as well as permitted ones.