Design an internal AI assistant for employees

A company of about 100,000 employees wants a chat assistant that answers from its internal knowledge sources, citing them. Each employee may only see some sources, decided by existing identity and policy services.

Design it: storing conversations and their context, checking permissions on every turn (failing closed when unsure, and making a revoked permission take effect within about a minute), retrieval, generation and streaming, an audit record per answer for compliance, keeping retrieval and model costs under control, and recovery. Conversations are kept 30 days and audit records a year.