Giving an agent a knowledge base
The knowledge base is a tool hanging off the agent, pinned to one id by the workflow. What that buys you is a boundary the model cannot argue with.
You have the knowledge base right. Something now has to decide when to consult it, what to do with what comes back, and what to say when the answer is not in there. That something is the agent, and almost all of it is configuration you can read.
The knowledge base is a tool, not a step
4.3 · Answer website chat questions with AI
Four boxes. The search does not sit in the flow — it hangs off the agent's tool handle, and runs only if the agent decides to use it.
Scroll for all 4 steps →
Nothing in this workflow searches anything. The Search Knowledge Base box is available to the agent, in the way a reference book is available to a person, and a run where the agent never opened it is a normal run. That is the difference between a tool and a step, and it is worth saying out loud in a demo — people assume the search always happens.
The workflow chooses the knowledge base. The agent cannot.
The tool carries a knowledge-base id, and it is fixed on the canvas by whoever built the workflow. This one points at customer knowledge base — the customer-facing one — and there is no instruction the model can be given, or talked into, that lets it read anywhere else.
| Knowledge base | Can this agent read it? |
|---|---|
| customer knowledge base | Yes — its tool is pinned to this one |
| sales playbook (internal) | No. Not misconfigured, not permitted — unreachable |
| operations playbook (internal) | No. Not misconfigured, not permitted — unreachable |
customer knowledge base
- Can this agent read it?
- Yes — its tool is pinned to this one
sales playbook (internal)
- Can this agent read it?
- No. Not misconfigured, not permitted — unreachable
operations playbook (internal)
- Can this agent read it?
- No. Not misconfigured, not permitted — unreachable
This is the answer to “how do you stop it telling a customer our internal pricing rules?” Not a prompt instruction, not a filter on the output, not trust in the model. The internal playbooks are not connected to it. A partner who can say that sentence with the canvas open has just handled the hardest objection in an AI sales conversation.
It is the same reason Answering questions on three channels could say two agents share one brain: they are pinned to the same id. Change the id and you have changed what the assistant knows, on both channels, without touching a word of its prompt.
What the agent is told to do with it
Being able to search is not the same as searching sensibly. The instruction that governs it is a sentence in the prompt, and it does two things at once:
## Instructions
- Use the handbook tool for anything about products, documents, eligibility,
charges, timelines or branches. Answer from what it returns, not from
general knowledge about loans.
- If the visitor asks something the handbook does not cover, say so plainly and
offer a call with an advisor.
- When they give a name and a phone number, use the capture_lead tool to create
the contact with source "website".
- Keep answers to a few sentences. Give the number or the document name rather
than a paragraph around it.“Answer from what it returns, not from general knowledge about loans.” That clause is the whole reason this is safe. The model knows a great deal about loans in general, almost all of it wrong for this business — different lenders, different documents, different regulator. The instruction is what keeps a specific answer specific.
And what to do when it comes back empty
A search never comes back empty. You saw that in What a knowledge base is, and how search finds things — ask something the documents do not cover and you still get five results, ranked, with scores. Nothing in the retrieval says “I do not know”.
So the refusal is entirely the agent's job, and it is one line of English. “If the visitor asks something the handbook does not cover, say so plainly and offer a call with an advisor.” Delete that line and the assistant will confidently answer from whatever ranked first, forever, and nobody will notice until a customer repeats it back to an advisor.
Change one thing — ask it something it does not know
- Open the live website agent and ask it something in scope — what documents you need, how long it takes. Watch it answer from the handbook.
- Now ask something adjacent that the knowledge base does not cover: today's interest rate, or whether you personally will be approved.
- Read what it does. It should decline and offer a call, and the reason it declines is a sentence you can open.
- Find that sentence in the prompt, and read the Constraints below it. That is the compliance policy, in a text box, editable by the client's own team.
Try it
- Work out what would change if this agent's tool were pointed at one of the internal playbooks instead. Do not do it — say what a customer might be told.
- Write the one sentence you would add to a client's agent to stop it answering a question their industry does not allow it to answer.
That is the knowledge module. Where answers live, how to write one so it can be found, and how an agent is given access to them without being given access to everything. Next: What is already connected in your org.
Related lessons
Base rates — what a piece of evidence is actually worth
A face-recognition system that is 99.9% accurate and almost entirely wrong, and a number that sent an innocent woman to prison. Both are the same arithmetic, and it is the arithmetic that decides what any piece of evidence is worth.
ReadConfirmation and survivorship — what you never looked for
Two questions about evidence you did not go looking for. One is a rule you have to discover, and one is a pattern in five famous people — and in both, the thing that would have told you the truth is the thing nobody checks.
ReadLoss aversion, sunk cost and regression — what it costs you
Four questions you answer about yourself rather than about a scenario, and your own answers are the finding. Then the pattern that makes praise look useless and criticism look like it works, whatever you actually do.
Read