Knowledge Assistant with RBAC: Confluence, Notion, Drive

yaml
version: 1.4
owners:
  product: "Support Operations"
  tech_owner: "platform-engineering@company.com"
  risk_owner: "security@company.com"
regions:
  - us-east
  - eu-west
sources:
  - type: confluence
    label: "Confluence"
    space_allowlist: ["Support-Runbooks", "Premium-Playbooks"]
    space_denylist: ["Legal", "HR-Private"]
    incremental_sync_cron: "*/10 * * * *"
  - type: notion
    label: "Notion"
    db_allowlist: ["Policies", "Workarounds"]
    db_denylist: ["Leadership-Notes"]
    incremental_sync_cron: "*/15 * * * *"
  - type: drive
    label: "Drive"
    folder_allowlist: ["Support Policies", "Release Notes"]
    folder_denylist: ["Legal-Privileged", "Security-Incident"]
    incremental_sync_cron: "*/20 * * * *"
rbac:
  provider: "okta"
  role_mappings:
    TIER1: ["Support-Runbooks", "Policies", "Support Policies"]
    TIER2: ["Support-Runbooks", "Policies", "Workarounds", "Release Notes"]
    PREMIUM: ["Premium-Playbooks", "Workarounds", "Release Notes"]
  enforcement: retrieval_time
masking:
  pii_patterns: ["SSN", "CREDIT_CARD", "API_TOKEN"]
  action: redact
  audit_sample_rate: 0.2
confidence:
  thresholds:
    billing_queue: 0.68
    premium_queue: 0.62
  actions:
    below_threshold: escalate_to_sme
    above_threshold: require_agent_approve
escalation:
  sme_routing:
    billing_queue: "#sme-billing"
    premium_queue: "#sme-premium"
  sla_minutes:
    first_response: 2
    human_review: 8
observability:
  prompt_logging: enabled
  retrieval_logging: enabled
  acl_check_logging: enabled
  sink: "siem-kinesis-stream"
ui_integrations:
  zendesk_app: enabled
  servicenow_app: enabled
  slack_bot: enabled
  teams_bot: enabled
citations:
  require_citations: true
  max_sources: 3
answer_style:
  tone: "concise, policy-aligned"
  macro_tags: ["billing-update", "premium-incident"]
review_workflow:
  edit_distance_threshold: 0.25
  require_second_approver: false
  rollback_policy: "disable_assistant_if_citation_failures>5% for 10m"
residency:
  data_region_policy:
    us-east: "US-only processing"
    eu-west: "EU-only processing"
model_policy:
  provider: "azure-openai"
  train_on_client_data: false
  request_timeout_ms: 12000
slo:
  response_time_p95_ms: 1500
  answer_confidence_p75: 0.70
  availability: "99.9%"
change_management:
  approval_steps:
    - name: "Security Review"
      owner: "security@company.com"
      required: true
    - name: "Support Ops Sign-off"
      owner: "support-ops@company.com"
      required: true
    - name: "Legal Spot Check"
      owner: "legal@company.com"
      required: false

{
  "title": "Knowledge Assistant with RBAC: Confluence, Notion, Drive",
  "published_date": "2025-11-20",
  "author": {
    "name": "Alex Rivera",
    "role": "Director of AI Experiences",
    "entity": "DeepSpeed AI"
  },
  "core_concept": "AI Copilots and Workflow Assistants",
  "key_takeaways": [
    "Unify Confluence, Notion, and Drive behind strict RBAC so agents only see what they’re allowed to use.",
    "Follow a 30‑day path: Week 1 audit, Weeks 2–3 retrieval and prototype, Week 4 telemetry and expansion.",
    "Keep humans in the loop: agent approval, confidence thresholds, and SME escalation are standard.",
    "Measure impact like an operator: AHT down and CSAT up with audit-ready prompt and permission logs.",
    "De-risk legal/security: prompt logging, data residency, role-based filters, and no model training on your data."
  ],
  "faq": [
    {
      "question": "Will agents lose context switching to a new tool?",
      "answer": "No. The assistant lives in Zendesk or ServiceNow. Drafts, citations, and macro tags appear in the sidebar. Slack/Teams is optional for quick lookups."
    },
    {
      "question": "What if content is stale or contradictory?",
      "answer": "We weight by freshness and owner endorsement, surface citations, and allow agents to flag content. A drift report highlights pages that cause edits or rejections."
    },
    {
      "question": "Can we expose this to customers for self-serve?",
      "answer": "Yes, after the agent pilot. We apply stricter confidence thresholds, filter to customer-safe collections, and keep logs/audits identical."
    },
    {
      "question": "How do you prevent data leakage across roles?",
      "answer": "The pipeline checks current ACLs at query time and respects deny-lists. Sensitive folders never enter the index and we mask PII before generation."
    }
  ],
  "business_impact_evidence": {
    "organization_profile": "B2B SaaS, 600 support agents on Zendesk, Confluence+Notion+Drive stack, Slack for SME escalations.",
    "before_state": "Agents tab-hunted across tools; answers varied by person; access errors were common; SME channels overwhelmed; AHT trending up; CSAT slipping on incident tickets.",
    "after_state": "Assistant delivered governed drafts with citations in Zendesk; RBAC enforced at retrieval; SME escalations only on low confidence; telemetry visible in Support Ops and Security.",
    "metrics": [
      "AHT down 18% in Billing queue within 4 weeks",
      "CSAT up 5 points on incident-related tickets",
      "27% fewer SME Slack pings during pilot",
      "Agent approval rate stabilized at 72% with 0 policy leaks"
    ],
    "governance": "Legal/Security approved due to retrieval-time RBAC enforcement via IdP, full prompt/ACL logging to SIEM, PII masking, in-region deployment, and a human-approval gate; models not trained on client data."
  },
  "summary": "Support leaders: unify Confluence, Notion, and Drive into a governed knowledge assistant with RBAC. 30-day plan, agent-in-loop, and measurable AHT/CSAT gains."
}