# AI data readiness: organize the records your agents will rely on

https://palnau-systems.vercel.app/insights/ai-data-readiness-access-controls

Published 2026-11-10 by Oliver Palnau and the Palnau Systems team. Prepared with AI assistance. Audience: Business owners, operations managers and data owners.

AI data readiness means the right information can be found, understood, kept current and accessed only by the people and systems entitled to use it. Start with the records needed for one workflow rather than attempting to clean every company file. Resolve ownership and conflicting versions, preserve identifiers and test real questions. A searchable repository is useful only when the retrieved answer is current, appropriate and traceable.

## Key takeaways

- Prepare the data for a specific workflow before expanding company-wide.
- Assign owners and precedence rules to important information.
- Test retrieval quality and access boundaries together.

## Create a source register for one workflow

List the systems and documents needed to complete the chosen task. Record their owner, purpose, update frequency, access rules and the fields or topics they cover. Identify which source is authoritative for each important fact. A price in a sales presentation should not silently override the current approved price list.

Look for identifiers that connect records across systems. Customer names alone may be ambiguous; a stable customer ID is more useful. Document missing links and duplicate records before building retrieval logic around them. AI can help identify candidate inconsistencies, but the business owner must decide how conflicting records are resolved.

## Separate cleaning from policy decisions

Formatting dates, removing exact duplicates and standardizing field labels are different from deciding which policy is valid. Ask domain owners to review consequential conflicts. Do not let an automated cleanup process merge customers or delete records based only on a plausible similarity score.

In a hypothetical engineering consultancy, three folders contain different project handoff checklists. The operations lead selects the current approved version, archives the others with clear labels and assigns a review date. The AI assistant now has a defined source to retrieve. Uploading all three versions without that decision would merely make the confusion searchable.

## Preserve permissions through retrieval

A search index or document summary should not become a shortcut around the original access rules. Check permissions for the current user and task when retrieving information. Consider whether excerpts, cached answers and generated summaries require the same restrictions as their source material.

Test common employee roles with the same question. A project manager may need project status while a different employee should not see confidential commercial terms. Verify both successful authorized retrieval and denied unauthorized retrieval. The absence of an obvious link in the user interface is not an access control.

## Measure readiness through real questions

Collect questions employees actually ask while doing the work. For each, identify the expected source and what a correct answer should include. Include questions with no available answer, conflicting sources and expired information. The assistant should be able to say what is missing instead of filling the gap with a confident guess.

Copy-ready readiness brief: “For this workflow, identify the authoritative source for each required fact, its owner and update rule. List conflicts and missing identifiers. Test five routine questions and five difficult ones under the relevant employee roles. Show the source used and any unresolved gap.” This turns data preparation into a concrete deliverable rather than an endless cleanup project.

## First steps

1. Choose one workflow and list its required facts.
2. Create a source register with owners, update rules and access boundaries.
3. Resolve important version conflicts and record-linking problems.
4. Apply permissions to indexes, summaries and cached outputs.
5. Test routine, missing-answer and unauthorized-access questions.

## What to measure

Authoritative answer rate: Measure questions answered correctly using the designated current source.

Unresolved source conflicts: Track material facts with competing sources and no approved precedence rule.

Permission test pass rate: Verify expected access and expected denials across the employee roles using the workflow.

## Do we need to put everything in one database?

No. Existing systems can remain authoritative if the workflow can retrieve the necessary information reliably and apply the correct permissions. Consolidation is a separate decision with its own costs. Start by making ownership and access clear across the sources you already use.

## Can AI clean our data automatically?

It can assist with detection, extraction and proposed corrections. Use deterministic checks where possible and require review for consequential merges, deletions or policy changes. Keep an audit trail so the team can understand and reverse an incorrect correction.

## Sources and further reading

- [NIST AI Risk Management Framework](https://www.nist.gov/itl/ai-risk-management-framework)
- [NIST: Least privilege](https://csrc.nist.gov/glossary/term/least_privilege)

## Work directly with Oliver and his team

Oliver and his team can map the sources behind one workflow, resolve practical data gaps and connect the right information to the right people.

Free introductory call: https://calendly.com/oliverpalnau/30min

Services and scope: https://palnau-systems.vercel.app/services

Current pricing: https://palnau-systems.vercel.app/pricing