# Section 4: Check How AI Uses Company Data (RAG, APIs and MCP)

A customer writes to an online shop: "Please cancel order 24. I no longer need it." Before an AI assistant can help, three things matter: the shop's rule on cancellations, what is true about order 24 right now, and which action you want to approve before it happens. This section follows that request, and three other worked cases, to show how an assistant finds a rule, gets a live record and acts only with the access you allow.

## Answering from company files

Priya manages HR at a retailer, and an employee asks how many unused vacation days can be carried into next year. Instead of attaching the right policy to every question, the company gives the assistant a knowledge base: the policies, handbooks and guidance it may search, with current versions marked and sensitive documents restricted. The documents are split into passages, and a model trained to compare meanings turns each passage into a list of numbers called an embedding. Passages with related meanings end up close together, so a question about vacation days can find a policy that says annual leave. A vector database stores those lists, keeps them linked to the text and finds the closest matches. The matching passages go to the answering model with the question as context.

Finding information and using it to write an answer is retrieval-augmented generation, or RAG. Ask the assistant to show the passage beside its answer, and test it first with a question whose answer you already know.

## Sharing a file is not training

Maya manages purchasing for a renovation company and wants an assistant to check whether a signed contract allows a supplier's price increase. Training happens while a model is developed, when examples adjust how it responds. Supplying her contract as context gives the model the clause for this one answer and does not, by itself, change what the model has learned. A provider may separately use submitted material for later training, depending on its terms and settings, and saving the file in her account so she can ask again tomorrow is another separate decision.

So a promise that "we do not use your data for training" answers only part of her concern. She also needs to know where the file and conversation are kept, who can open them and when they are deleted, which is the retention period. Business account terms can differ from individual ones, and if another company provides the model behind the assistant, the contract passage may go there too.

## Connecting to a live record

Daniel works at an accounting firm, and a client asks whether invoice 104 has been paid. A contract says when payment was due, but only the accounting system says whether the money arrived this morning. His invoicing application offers the model a tool called "get invoice status" that needs an invoice number. The model asks to run that tool's function with the number 104, which is function calling. The application checks the request, runs the function, and the function asks the accounting system through its API. The record comes back, or a failure does: a missing invoice, an expired connection or a system that is down should be reported, not covered with a confident reply.

When several AI applications need the same tool, the program offering it is an MCP server, the connecting part inside the application is an MCP client, and the shared rules are the Model Context Protocol, or MCP. MCP does not grant access. The builder still connects the right account, and permission to read an invoice is separate from permission to change it, cancel it or issue money.

## Testing before you trust it

A demonstration with questions chosen in advance shows little. Priya starts with 20 real staff questions her team can check, including 3 difficult cases: a current policy missing from the searchable files, 2 versions that conflict, and a question with no approved rule. For each one she records the supporting source and the expected answer or an acceptable request for help, so an invented answer fails. She keeps every failed case and runs the set again whenever the search, instructions, model or tool connection changes. That repeatable test is an evaluation, or eval. Twenty questions is a first exercise for her, not a standard for every system.

She also tests prompt injection, an attempt to redirect the assistant through material it reads, by adding a harmless instruction to a test copy of a policy. EchoLeak, a historical case from 2025, showed why: a crafted email could make Microsoft 365 Copilot disclose information from its working context without anyone clicking a link or opening an attachment. Microsoft patched it before it was publicly disclosed.

## What changes the wording, and what changes the model

"Thanks for getting in touch" and "Thank you for your message" both do the job. The model writes in tokens and selects each next piece from several likely ones. Temperature changes how strongly the likely choices are favoured, and top-p changes which group of choices is considered. Both work while the answer is being written, and neither checks whether a statement is true. Parameters are the numerical values the model learned in training. Fine-tuning trains an existing model further with selected examples, such as approved replies, and changes those values. Try clear instructions and examples first, and remember that a model trained on your style still needs current information to answer a question about an order.

## Building and running the work

Maya wants a supplier-price report every Monday, even when her laptop is closed. The cloud, computing and storage rented over the internet, gives the job a place to run, but it does not decide what the job does or keep supplier connections working.

A builder might write custom software, use a framework such as LangChain or CrewAI, arrange the steps in a visual workflow tool such as n8n, Zapier or Make, or combine them. Claude Code or Codex can help write the custom parts from clear requirements. Deployment puts the finished workflow where the schedule can run it. Someone still has to provide access to the supplier sources, receive the failure notice, pay the running cost and repair a connection when a supplier changes something. A useful failure notice names the affected source.

## Judging an AI product by the work it completes

One seller says, "Our AI agent handles customer support." Another says, "Our assistant checks orders and prepares replies for you to approve." Give both the order-24 request. The assistant needs the shop's rule, which a knowledge base can supply, and order 24's current status, which a connected tool can look up. Ask whether the model chooses those steps or a fixed workflow follows them.

A drafted reply has not cancelled anything. Cancelling needs a cancellation tool and permission to use it, and reading, cancelling and replying are separate actions you can allow separately. Ask for a demonstration on a test order, approve the test action, and check that the order record changes. A message saying "done" is weaker evidence than the updated record.

## Back to order 24

The rule comes from a searched knowledge base, which is the RAG part. The live status comes through a connected tool and an API, and MCP can give compatible applications a common way to offer and call that tool. The order record stays the proof of whether the cancellation happened. Three more questions belong to the same system: how long it keeps customer information, whether it passes your saved test cases, and whether instructions inside a message or document could redirect it. You can now ask what any AI product reads, what it changes and what it leaves for a person.