Specialist review
Specialist review only. Use this page when the topic is concrete; the simple entry point remains the AI check.
Tirion M365 Company Brain Architecture
M365 Company Brain Architecture
An architecture model for organizations that want to use Microsoft 365 knowledge without ignoring permissions, stale sources or unsupported answers.
Start AI check
Framework overview
An M365 Company Brain is not just a chatbot over SharePoint. It needs curated sources, permission hygiene, sensitivity, metadata, secure retrieval, source-backed answers, refusal behavior, evaluation and operations. The Copilot logic applies here too: permissions, data classes and responsibilities must be defensible before rollout.
The Secure Knowledge Architecture
The framework starts with sources rather than the model: who is responsible for them, who may read them, how fresh they are, which answer may be created and when the system must refuse. A Company Brain should never scale faster than permissions and responsibilities.
Sources are limited, assigned to responsibilities and enriched with validity, sensitivity and system-of-record metadata.
Answers respect permissions at query time or in the index and stay source-backed.
Freshness, wrong answers, access reviews, retention and incidents are treated as operations processes.
Each dimension is scored from 0 to 3. A Company Brain is reliable only when sources, rights, metadata, answer behavior and operations are clarified together.
Company Brain production-ready for the defined scope.
Pilot-ready with limited sources.
Preparation phase: curate permissions and sources.
Do not index. Repair governance first.
Readiness dimensions0-3
Source responsibility
0-3Does every knowledge source have a responsible business lead?
Permission Hygiene
0-3Are SharePoint, Teams and Drive permissions cleaned up and group-based?
Sensitivity
0-3Are confidential, personal and regulated contents marked?
Ingest Scope
0-3Is it clear which sources enter phase 1 and which do not?
Metadata Quality
0-3Are URL, owner, date, system of record and validity stored?
Freshness
0-3Are freshness rules and stale-source handling defined?
Retrieval Security
0-3Are permissions respected at query time or in the index?
Source-backed Answers
0-3Are sources, citations and uncertainty visible in the answer?
Refusal Behavior
0-3Does the system refuse when sources are missing or contradictory?
Evaluation
0-3Are test questions, gold answers, negative tests and review available?
Feedback Loop
0-3Can users report wrong, stale or missing answers?
Operations
0-3Are monitoring, audit, incident, retention and deletion processes defined?
Hard stop criteria
- SharePoint or Teams permissions are unclear at broad scale.
- Answers can appear without sources.
- No deletion or retention logic.
- External actions are coupled with knowledge access without a permission model.
- No process for confidential, personal or regulated data.
Short checklist
- Phase-1 sources deliberately limited.
- Responsible lead, URL, date, sensitivity and system of record captured for each source.
- Permissions, guests and shared links checked.
- Source requirement and not_enough_sources behavior defined.
- Prompt injection and RAG poisoning tested.
- Feedback, freshness report, access review and incident process available.
Where to use this framework
Cut the first source scope so rights and quality remain testable.
Connect SharePoint, Teams and Drive with owners, metadata and source-backed answers.
Specify when the system answers, answers with uncertainty or refuses.
Executive FAQ
Why is SharePoint search not enough?
A Company Brain creates, summarizes and prioritizes answers. That requires source-backed answers, permission handling and refusal behavior.
Which sources should be indexed first?
Only limited phase-1 sources with an owner, clear validity, cleaned permissions and known use case.
What does not_enough_sources mean?
The system refuses or marks uncertainty when source coverage is not sufficient or contradictory.
Start now
Need this translated into a real decision?
Use the AI check to identify the strongest AI, cloud or approval lever before choosing a next step.