12 best practices for accurate, secure answers from your private AI assistant

Most organisations now accept that generative AI can save time. The harder question is how to get answers that are accurate, safe and trusted enough for real work. An assistant that confidently gives a wrong leave entitlement, or quotes last year's price list, loses users' trust within a week.

The good news is that most accuracy and security problems are predictable and preventable. These 12 practices come from our implementation work. They separate an AI pilot that quietly fades away from one the whole organisation relies on.

1Start with a problem, not a platform

The most successful rollouts begin with one or two specific, high-volume questions, not with "let's give everyone AI". Look for knowledge work that is:

• Frequent: asked many times a week, such as HR policies, IT how-tos or product specs.
• Document-based: the answer already exists in writing somewhere.
• Measurable: you can count tickets, emails or hours before and after.

Define success up front, for example "reduce HR policy enquiries by 30% in three months" or "cut tender first-draft time from three days to one". As we discussed in Measuring value and ROI from beginning to end of your IT projects, a baseline measured before go-live is what lets you prove value afterwards.

2Curate your content: garbage in, garbage out

An AI assistant is only as good as the documents it can read. Before you upload everything on the shared drive:

• Remove outdated and duplicate versions. If three versions of the travel policy exist, the AI may quote the wrong one.
• Prefer text-based files over scanned images, and clear headings over walls of text.
• Name files descriptively, e.g. "HR – Leave Policy – 2026.pdf", not "final_v3_new.pdf".
• Assign a content owner for each knowledge area who keeps it current.

A smaller set of well-maintained documents beats a large set of messy ones every time.

3Design workspaces around audiences and purposes

Organise knowledge into separate workspaces, such as HR Policies, IT Helpdesk, Sales Collateral or Client A, rather than one giant knowledge base. Focused workspaces:

• improve accuracy, because the AI searches a smaller, relevant set of documents;
• make access control simple, because users only join the workspaces they need; and
• let you tune each workspace's instructions, AI model and settings for its purpose.

Use threads within a workspace to keep separate conversations and topics apart.

4Choose the right answer mode

Private AI assistants such as Hiend Mindspace typically offer two answer modes, and choosing the right one matters:

• Query mode answers only from your documents and says when it can't find the answer. Use it for policies, compliance, technical manuals and anything where a made-up answer would be harmful.
• Chat mode blends your documents with the AI model's general knowledge. Use it for drafting, brainstorming and explanation.

5Write clear workspace instructions

Every workspace should have a system prompt: standing instructions that shape every answer. A good one defines:

• Role and audience: "You are the HR policy assistant for employees of [Company]."
• Rules: "Answer only from the provided documents. If unsure, say so and refer the user to the HR team."
• Format: "Give a short answer first, then details. Always cite the policy name."
• Context variables: insert the current date, the user's name or your company name automatically, so answers stay relevant, e.g. "Today is {date}."

Review and refine the prompt as real questions come in.

6Get chunking and retrieval settings right

Behind the scenes, documents are split into chunks that the AI searches to find relevant passages. A few settings have an outsized effect:

• Chunk size and overlap. Short, self-contained reference entries (FAQs, specs) work well with smaller chunks. Narrative documents where meaning builds over paragraphs (reports, contracts) do better with larger ones. Change one setting at a time, and remember that documents must be re-embedded for a new setting to take effect.
• Number of context snippets. Sending 4–6 relevant passages to the AI is a good default. Too many add noise; too few miss information.
• Similarity threshold. This filters out low-relevance passages. If users often get "no relevant information found" when you know the answer is there, the threshold is probably too strict.
• Re-ranking. An "accuracy optimised" search retrieves more candidate passages and re-ranks them for relevance. It's slightly slower, but noticeably better for large document collections.

7Pin critical documents and keep content fresh

For a small number of critical documents, such as a code of conduct or a current price list, pin them to the workspace so the AI reads the full text rather than just the most relevant snippets. Use pinning sparingly: it improves comprehension but uses more of the AI's context window and costs more.

For content that changes, like web pages, wikis and Confluence spaces, turn on automatic document sync so the assistant re-reads sources when they're updated. Schedule a quarterly content review for everything else.

8Teach users to ask good questions and check sources

Even the best system benefits from good questions. A short training session goes a long way:

• Be specific: "What is the hotel claim limit for a manager travelling to Japan?" beats "travel rules?"
• Use the organisation's own terms, the words used in the documents.
• Always check the citations for important decisions. Cited sources are what make AI answers trustworthy and auditable.
• Know the limits. Retrieval-based assistants find relevant passages. They don't "read everything at once", so a question like "list every contract that mentions penalties" is better handled by an AI agent or a search tool.

9Apply least-privilege access, for people and for AI agents

• Use multi-user mode and assign roles deliberately: a few Admins, a handful of Managers who look after workspaces, and Default users who can only chat in the workspaces they're added to.
• Review workspace membership whenever people change roles or leave.
• Give AI agents only the tools they need. Connect SQL agents with a read-only database account. Prompts alone can't guarantee an agent never runs a destructive command.
• Require human approval for agent actions that send, change or delete anything.
• When connecting agents to internal systems through the Model Context Protocol (MCP), forward the user's identity so your systems enforce the same permissions they do for that person, and protect the connection with a shared secret or a private network.

10Match the AI model to the sensitivity of the data

Not all data should go to the same place:

Also remember:

• Personal "memories" and system prompts are sent to the AI provider with each request. Never store passwords, API keys or sensitive personal data in them.
• Turn off optional telemetry if your policy requires it.
• To honour a data-deletion request, delete the document from the central document library, not just from one workspace, so its text and cached embeddings are removed everywhere.
• Document all of the above in your AI usage policy and your PDPA data-protection records.

11Control costs from day one

AI costs are usage-based and can surprise you. Keep them predictable by:

• using a model router to send simple questions to fast, low-cost (or local) models, and only complex reasoning to premium models;
• setting daily and per-session chat limits on public-facing website chat widgets, and restricting them to your own domains;
• keeping only the agent tools you need switched on, since each tool adds to the prompt size; and
• monitoring usage per workspace each month.

12Measure, learn and iterate

Treat your AI assistant as a living service, not a one-off project:

• Review chat logs regularly, with appropriate privacy safeguards, to find unanswered questions. They usually point to missing or outdated documents.
• Collect feedback from users on answer quality.
• Track the success measures from practice 1 and report them in business terms: hours saved, tickets avoided, faster turnaround.
• Expand gradually: once one workspace proves its value, add the next use case, more data sources, and agent automations for routine tasks.
• Invest in change management. Appoint champions in each department, share quick wins, and make the approved AI assistant easier to use than the unapproved alternatives.

The bottom line

The organisations getting real value from AI aren't necessarily the ones with the biggest budgets or the newest models. They curate their knowledge, design for accuracy, govern access carefully and keep improving based on evidence. Get these foundations right, and a private AI assistant becomes one of the most-used tools in the organisation.