Start with the job after the answer
Ask what the employee will do with the response. Finding the current onboarding page, locating a template, or summarizing a long approved report can remain a retrieval task. The employee can inspect the source and continue manually. A well-configured internal chatbot may be the smaller and better system.
The architecture changes when the response determines a price, personnel decision, customer commitment, approval, or system update. The business now needs to know which record governed the answer, whether the requester could see it, who owns the decision, and what happened at the destination.
Calling both systems a chatbot hides that shift. One improves access to information. The other participates in an operating control chain.
A chatbot can stop at cited retrieval
Microsoft's retrieval-augmented generation guidance separates retrieval from generation and recommends access control during retrieval. That pattern can support a useful internal assistant without giving the model authority to change another system.
The chatbot should show the source, state when evidence is missing, and remain inside the user's access boundary. It does not need to resolve every source conflict if the employee remains the decision maker and can inspect the record.
This level is often appropriate for policy lookup, technical documentation, historical research, and drafting. Adding a workflow engine would increase cost and failure surface without changing the job.
A Business Brain owns the route to a controlled result
The Business Brain begins before retrieval. The team names the facts required for a decision, the authoritative source for each fact, the conditions that change authority, and the safe behavior when evidence is missing or disputed. The requesting identity follows the query into retrieval.
After the model proposes a result, application rules determine whether it remains an answer, becomes an approval request, or can enter a narrow write. The destination response is verified and attached to the same operating record. The model does not acquire business authority merely because its wording is confident.
| Question | Internal chatbot | Business Brain |
|---|---|---|
| Primary job | Find and summarize approved material | Support a repeated decision or controlled action |
| Source rule | Relevant permitted sources | Named authority and conflict behavior for each material fact |
| Decision owner | Employee using the answer | Explicit accountable role in the workflow |
| Action | Usually manual and outside the assistant | Bounded tool with validation, approval, and destination check |
| Evidence | Citation or source link | Citation plus decision, approval, action, and outcome record |
Test the difference with hostile and failed cases
Compare the systems by requesting a restricted record, removing the user's access before repeating the query, presenting two approved sources with different terms, leaving the required owner unavailable, rejecting the destination write after approval, and placing a hostile instruction inside retrieved content.
OWASP's prompt-injection guidance describes how instructions can arrive through documents and other retrieved content. The application must keep that content inside the evidence boundary rather than letting it redefine tool authority.
If the business does not need to control a decision or action, stop at the chatbot. If it does, require the full route to pass. A larger name should correspond to a larger operating obligation.
Sources and verification
Primary product, architecture, risk, and security sources checked on 29 August 2026. Product behavior can change, so verify current plan and admin documentation before implementation.