Their teams were already using AI. Just not safely.

Clinical material was going into public chat tools.

Our client is a global pharmaceutical organisation. Its research, clinical and marketing teams produce a lot of written work, on tight deadlines, from source material that has to be handled with care.

Some of that material was being pasted into public AI chat tools. Not out of carelessness. The source documents were hard to find, the deadline was real, and the public tool was right there.

The policy was there. A safe alternative was not.

The organisation already had a clear rule: confidential scientific and clinical material must not go into external tools. People broke it anyway, because there was no approved option that was quicker.

The material they needed lived in a SharePoint estate that had been growing for over a decade. Clinical study reports, prior submissions, approved brand language. Finding the right documents was slow, and it assumed you already knew they existed.

Compliance could not see any of it.

The compliance team had no view of which tools were in use, what was being pasted into them, or whether the text that came back followed scientific and regulatory guidelines. There were no logs and nothing reproducible.

Because everyone was improvising with different tools and prompts, the same therapy area was being described differently in different markets. That is a commercial problem and a regulatory one at the same time.

What they needed from us.

A stricter policy would not have fixed this. They needed an AI platform their people would actually reach for: one that ran inside their own environment, respected who is allowed to see what, and kept a record of everything.

First, we made a decade of documents searchable.

We started with the content, not the AI. We built an ingestion pipeline on GPU-backed container apps that processes the source documents and pulls out tables and structured content intact.

That material is then shaped for retrieval around the organisation's own taxonomy, rather than around whatever a folder happened to be called years ago. It is unglamorous work, and it decides whether everything downstream is any good.

Then we made sure nobody sees what they shouldn't.

The question that shaped the whole design was simple: when someone asks a question, where does the permission check happen?

We put it inside the search itself. Each user's group memberships travel with their request, and retrieval filters against them at query time. A document the user cannot already open is never even a candidate, so it never reaches the AI model.

That meant one index for everyone, not one per person. And the existing SharePoint permissions stay the source of truth, so the security model is one the organisation already understood and already audited.

Different requests went to different AI agents.

Not every request was the same. Most needed answers from internal documents. Some needed current outside information, such as a newly published paper or a regulatory update. Some asked for content to be updated rather than read.

So we built specialised AI agents behind a coordinator, orchestrated with LangGraph. The coordinator routes each request and runs the guardrail check: nothing goes back to the user without passing it.

• A retrieval agent for the internal SharePoint content.
• A web access agent for outside information. It is off by default, and every use is on the record.
• A content update agent for changes, not just answers.

One voice across markets, and a record of everything.

Standard system prompts keep scientific accuracy, brand tone and regulatory messaging consistent across teams and therapy areas. The same molecule is described the same way in two markets because the same system is saying it.

Every retrieval, agent action, external reference and generated answer is logged, with the user and the time. Now the compliance team can reconstruct how a piece of AI-assisted text was produced.

What changed.

Six months after kick-off, the platform was in production inside the client's own Azure tenant. Ingestion, indexing, embeddings and model calls all run there. No document is sent to a third-party model.

Teams now have an approved way to use AI on their own material, with the permissions they already had. Compliance has a full audit trail where before it had nothing.

Those are properties of how the system is built, not measured business results. The client has not published usage or time-saved figures, so neither do we.

Where they are now.

Some of the remaining work is organisational, not technical. Permissions inherited from a decade of SharePoint include old decisions nobody remembers making, and the platform makes them more visible than manual search ever did.

Who gets the web access agent, and for what, is a policy decision for the client. And the documents need ongoing curation, so retrieval stays good enough that the approved path remains the easy one.