How to create industry-specific knowledge bases for AI agents

Healthcare, legal services, manufacturing, staffing, and financial operations each contain thousands of possible knowledge jobs. An agent that helps a maintenance engineer diagnose an alarm needs different evidence and controls from one that prepares a regulatory filing, even inside the same company.

Name the actor, question, consequence, evidence, and next action. A useful first scope might be helping a field technician find an approved procedure for one equipment family, or helping a recruiter assemble candidate and client context before a review. The narrower workflow determines which sources matter and what failure must do.

NIST's AI Risk Management Framework asks organizations to map context and manage risk across the lifecycle. For a domain knowledge base, context is not a preface. It changes acceptable evidence, review, metrics, and authority.

Begin with the fact types the workflow consumes: customer status, equipment specification, policy rule, contract term, patient instruction, incident history, or regulatory obligation. For each type, record its primary source, supporting evidence, owner, scope, effective period, audience, and conflict behavior.

Add relationships only when they support retrieval or a decision. A maintenance procedure may apply to a model and serial range. A contract clause applies to an agreement, jurisdiction, and date. A staffing requirement applies to a role, location, and client. Generic tags such as finance or operations are too broad to control these distinctions.

Keep formal identifiers beside ordinary language. Employees may ask for the latest safety sheet while the controlled system uses a product code and document class. The knowledge layer should connect the terms without creating a second unofficial source.

A retrieved passage can be relevant and still be wrong for the decision. A recent chat message may mention the exact issue while an approved procedure owns the operating rule. A client email may explain intent while the signed agreement controls the obligation.

Store authority class and scope in retrieval metadata. When two approved sources disagree, return the conflict and owner route. Do not let semantic similarity, recency, or the model's preferred wording silently decide which record wins.

ISO 30401 treats knowledge management as an organizational management system that must be established, maintained, reviewed, and improved. The corporate knowledge base operating model applies that discipline to source ownership and lifecycle before AI is added.

An industry-specific agent often crosses sensitive boundaries: client, patient, matter, plant, geography, role, or regulated record class. Filtering the final answer after retrieval is too late because restricted text has already entered the model context.

Microsoft's guidance for secure multitenant RAG describes tenant isolation at storage or filter layers. The correct pattern depends on the application, but the test is the same: the user's identity and permitted scope must constrain retrieval before the model sees evidence.

Test two users asking the same question under different roles, a revoked user, a record moved between scopes, and an administrator troubleshooting the system. Inspect retrieved passages, citations, logs, caches, and proposed actions, not only the sentence shown on screen.

A glossary earns its value where terms collide. The same abbreviation can mean different things across departments. A product nickname may refer to several generations. A regulatory term may have a precise definition that ordinary conversation uses loosely.

Collect real questions, search failures, field names, controlled vocabularies, and aliases. Record the definition, owner, scope, and source. Include exclusions and near-matches. A useful glossary helps retrieval distinguish terms; it does not replace the underlying record that owns the fact.

Evaluate with paraphrases, acronyms, misspellings, historical names, and terms used differently by two roles. The goal is not to make every word equivalent. It is to route the question to the correct domain evidence or ask for the missing distinction.

Generic question-answer benchmarks do not show whether the system supports the selected workflow. Build a case set with known answers and decisions from the people who own the work. Include ordinary cases, boundary conditions, stale records, missing evidence, conflicts, restricted sources, and a request outside the agent's approved role.

Score evidence retrieval separately from answer quality. A model cannot repair a missing authoritative passage. Check whether the correct source was available, retrieved under the right identity, cited accurately, interpreted within scope, and limited when the evidence could not support a conclusion.

Measure consequences the owner recognizes: review time, correction type, unresolved questions, permission defects, stale-answer escapes, and whether the output supported the next step. A high count of answered questions can hide a weak or unsafe system.

• Known answer under the correct role
• Same question under a restricted role
• Two authoritative sources with different effective dates
• Industry term with two plausible meanings
• Missing fact that requires clarification or escalation
• Retrieved document containing a hostile instruction
• Proposed action outside the agent's approved scope
• Changed source followed by a freshness verification

A permitted document can still contain malicious or irrelevant instructions. Customer submissions, email, tickets, uploaded manuals, and copied web content can carry text that tries to change the agent's role or invoke a tool.

OWASP's prompt-injection prevention guidance describes indirect attacks delivered through retrieved material. Separate instructions from evidence, keep tools narrow, validate structured inputs outside the model, and require approval where an action has material consequence.

Add hostile test records that resemble normal industry documents. The safe result treats the embedded instruction as data to ignore or report. It must not reveal another record, weaken access, or expand the agent's tools.

An answer and an action have different failure costs. Let the first version retrieve and explain evidence. Once that route passes, define one narrow action with validated inputs, an accountable owner, approval where needed, destination version checks, idempotency, and a recorded outcome.

Do not give a general industry agent broad write access because its knowledge appears specialized. A staffing agent that prepares a candidate review should not change employment status. A maintenance assistant that identifies a procedure should not close a safety incident. Capability boundaries belong in application code and permissions, not only in a prompt.

For source mapping, evaluation, implementation, and handoff, review the AI knowledge base development service. The first release should prove one domain route before adding another industry or action.