Six Steps from Scattered Content to an Answer You Can Defend

Getting from scattered enterprise content to an answer an agent can defend takes six things, in order: connect, secure, enrich, find, ground, and deliver. They are the working parts of a context layer, set out here as a sequence rather than a category. Each step does one job the next depends on, so skipping one does not produce a slightly worse answer; it produces a specific, predictable failure.

Step	What it does	What it prevents
1. Connect	Brings every source together, from SharePoint and Confluence to ServiceNow and file shares, reaching content where it lives.	Answers drawn from a partial view of the organization, confidently given and quietly incomplete.
2. Secure	Permissions travel with the content. Access rules come along with every document and are checked each time someone asks.	An agent that answers correctly from a document the person asking was never allowed to open.
3. Enrich	Finds the passage, not just the file. Content is split into meaningful passages, so the agent gets the paragraph that answers the question.	Retrieval that returns a 200-page PDF and leaves the real work to the reader.
4. Find	Matches exact terms and meaning together, so a part number and a plain English question both reach the right content.	A system that handles one query style well and silently fails the other.
5. Ground	Builds every answer from approved content and cites the specific passages it came from.	Fluent answers that nobody can trace, verify, or defend.
6. Deliver	Returns the right answer, or takes the right action, within policy. What was asked, shown, and answered stays on the record.	Agent activity that cannot be reconstructed when a regulator or an auditor asks what happened.

Step one: connect

Connect means bringing every source together, from SharePoint and Confluence to ServiceNow and file shares. In most organizations that list runs longer than anyone expects: a document management system, a case management system, a contract repository, a wiki, a ticketing system, an email archive, and several network drives that predate the current IT organization.

Technically this is about connectors and change capture, not migration. The work is to reach content where it lives, detect additions, edits, and deletions as they happen, and normalize very different formats into something a retrieval system can work with. A scanned PDF, a Confluence page, a .msg file, and a ServiceNow article all have to arrive in a comparable shape, carrying their metadata and their permissions with them. Permissions especially, which is what step two depends on.

The failure this prevents is the most common one in enterprise AI pilots: an agent that sounds authoritative while reading from a fraction of the organization. A pilot indexed against the wiki answers policy questions from the wiki, including questions where the wiki is six months behind the system of record. Nobody sees a gap. They see a wrong answer delivered in the same calm tone as a right one.

Concretely: a support rep asks whether a customer’s issue is a known defect. The known-defect list lives in the engineering tracker. If the tracker was never connected, the agent answers from release notes and says no. Reaching sources where they already live, through enterprise data acquisition, is what makes the rest of the chain possible.

Step two: secure

Secure means permissions travel with the content. Access rules come along with every document and are checked each time someone asks, so the agent sees exactly what the person asking is allowed to see.

The important word is each. There are two ways to handle access in a retrieval system, and only one holds up. The first filters after the fact: retrieve broadly, then remove results the user should not see. The second carries each document’s access control list (ACL) through ingestion alongside the content, resolves the asking user’s group memberships at query time, and constrains retrieval itself by those entitlements. The first leaks, because anything that shapes the answer before the filter runs has already shaped the answer. The second means an inaccessible document cannot contribute at all, because it was never a candidate.

This also has to survive change. People move teams, matters get walled off, a deal team goes restricted, an employee leaves. If entitlements are resolved once at index time and cached, the system is accurate on the day it was built and progressively wrong afterward. Evaluating per query against current group membership is the only version that stays true.

Agent identity is the genuinely unsettled part across the industry. When an agent acts on someone’s behalf, and especially when it calls another agent, whose entitlements apply has to have a clear answer at every hop. Treat any system that cannot tell you whose permissions it enforced on a given call as unfinished.

Step three: enrich

Enrich means finding the passage, not just the file. Content is split into meaningful passages, so the agent gets the paragraph that answers the question instead of a 200-page PDF.

The distinction is passage-level retrieval versus whole-document retrieval. Whole-document retrieval treats a file as the unit: it decides the plan document is relevant and hands over the plan document. Passage-level retrieval treats a span of text as the unit, so the system can determine that section 7.4.2, three paragraphs on a single page, is what the question was about. For a human with time, whole-document retrieval is merely annoying. For an agent working inside a context window it is the difference between a usable answer and a summary of the wrong thing, because a model given a long document attends to the parts that look topically similar rather than the parts that are governing.

Doing this well is harder than splitting on a fixed character count. Fixed-size chunking cuts tables in half, separates a clause from the definition it depends on, and strips headings that carry the only indication of which product or jurisdiction a section applies to. Structure-aware approaches such as AI Chunking split along the document’s own boundaries and carry surrounding context forward, so a retrieved passage still knows what it is part of.

Enrichment also covers metadata: effective dates, document status, jurisdiction, and version. A passage that cannot say whether it is current is a passage you cannot ground an answer on.

Step four: find

Find means exact terms and meaning, together. This is one step rather than two because enterprise users ask both kinds of question, often within the same hour, and a system tuned for one quietly fails the other.

Exact identifiers need literal matching. A part number, a policy number, a form number, a procedure code, a statute citation, or an internal document ID has no useful semantic neighborhood. Nearly matching an identifier is not a partial success; it is a confident answer about a different thing. Keyword and lexical matching handles these correctly because it looks for the string, not the concept.

Natural language questions need the opposite. “Can a client hold this in a retirement account” shares almost no vocabulary with the paragraph that answers it, which will talk about qualified accounts, eligible holdings, and permitted instruments. Vector search handles this by comparing embeddings, numerical representations of meaning, so related ideas sit near each other regardless of wording.

Running both and combining the results is what neural hybrid search does. The engineering substance is in the combination: how results from each method are scored against each other, and how the balance shifts with what the query looks like. A query that is mostly an identifier should weight lexical matching heavily, a conversational question should weight semantic matching heavily, and most real queries are a mix, like “is form 1099-B required for this.” Test both paths deliberately. Teams that evaluate only on natural language questions ship systems that cannot find a part number, and discover it when a user tries.

Step five: ground

Ground means truth, not guesses. Every answer is built from approved content and cites its sources. In practice that is two commitments: constraining what the model may answer from, and attaching provenance to what it produces.

Constraint comes first. A grounded system answers from the passages retrieved in the previous steps, and when those passages do not contain an answer it says so rather than filling the gap from training data. “I could not find guidance on this” is a correct and useful response. A plausible paragraph assembled from general knowledge is neither, and it is indistinguishable from a real answer at a glance.

Provenance is the other half. A citation worth having identifies the specific passage, not just the document: the section, the page, the clause, and the version or effective date it came from. “See the employee handbook” is a gesture. “Section 4.3 of the handbook, effective March 2026” is something a person can check in ten seconds and an auditor can check later. The practical test is whether someone can answer “show me what the agent saw” without filing a support ticket.

Grounding is also where currency gets enforced. If a superseded policy and its replacement are both retrievable, the system has to prefer the current one and say so when it quotes something historical, which is what step three’s metadata work makes possible. The failure all of this prevents is subtle, and that is what makes it dangerous. Ungrounded answers are fluent, well-formatted, and often correct, exactly the profile that gets trusted for months before anyone checks one.

Step six: deliver

Deliver means the right answer, or the right action, within policy. What was asked, shown, and answered stays on the record.

A system can deliver three distinct things, and treating them as one is a common design error. The first is returning documents: a ranked list, interpretation left to the person. That is search, still the right output for exploratory work where someone needs the range of what exists. The second is returning a grounded summary: a synthesized answer with citations back to the passages it used, right when the question has an answer and evidence has to travel with it. The third is taking an action within policy: filing the ticket, drafting the response, updating the record, or routing the case. Here the stakes change, because an action has effects a wrong answer does not.

Actions need policy boundaries outside the model: what this agent may do, on whose behalf, up to what threshold, and what requires human approval. Those boundaries belong in the layer the agent calls, not in a prompt, because prompts are suggestions and policy enforcement is not.

Protocols matter here. The Model Context Protocol (MCP) is the widely supported baseline for how agents pull context through tool calls at runtime, and Agent2Agent (A2A) reached 1.0 in April 2026 under the Linux Foundation with signed Agent Cards. Both reflect the 2026 reframe from push to pull: agents fetch context when they need it rather than having it stuffed into a prompt in advance. Then the record: every question, retrieved passage, answer, and action logged with the identity it was performed under. An agent whose activity cannot be reconstructed cannot be put in front of a regulated process.

What breaks when you skip a step

The framework is easier to remember backward. Each step exists because of a specific failure, and that failure arrives reliably when the step is missing. These are not edge cases; they are the normal outcome.

Skipped step	What you get instead
Connect	An agent that is confident and partial. It answers from whatever happened to be indexed, with no signal that the authoritative source was never in scope.
Secure	An agent that answers correctly from a document the person asking was never allowed to open. Worse than no answer at all, because the exposure stays invisible until someone notices, and by then it has happened many times.
Enrich	An agent that hands back a 300-page document and calls it an answer, or summarizes the document’s general theme instead of the one clause that governs the question.
Find	A system that works beautifully in the demo and fails on real traffic, because the demo used conversational questions and real users paste part numbers.
Ground	Fluent answers nobody can check. Right often enough to be trusted and wrong often enough to be dangerous, with no way to tell which is which without redoing the work.
Deliver	Agent activity you cannot reconstruct. When someone asks what the agent saw and why it acted, the honest answer is that nobody knows.

The same six steps in three regulated industries

The steps do not change by industry. What changes is which failure costs the most and what the evidence has to look like. The scenarios below are illustrative, not descriptions of any organization’s deployment.

Financial services: a wealth or banking firm

Connect brings research, compliance guidance, and client records into one governed source instead of three systems an advisor searches separately. Secure means an advisor’s agent sees that advisor’s clients and nobody else’s, checked on every query rather than inferred from a role. Enrich means finding the one paragraph of guidance that applies, not the 80-page policy around it. Find means a policy number and a plain English question both land correctly. Ground means talking points cite current research and the compliance guidance behind them, with effective dates attached. Deliver means that when supervision asks what the agent saw, there is an answer. Retention and supervision obligations are the firm’s to satisfy and belong in financial services vendor criteria.

Healthcare: a health plan

Connect reaches policy documents, prior determinations, and member records across systems never designed to talk to each other. Secure means a claims adjuster’s agent sees this member’s record and not the next member’s. Enrich means pulling the exact coverage clause out of a 300-page plan document instead of returning the document. Find means a procedure code and “is a follow-up visit covered” both reach the right policy section, the clearest illustration of why both matching styles are mandatory. Ground means every answer cites the policy section and the precedent determination behind it. Deliver means compliance can show what the agent saw, which is what makes a determination reviewable. Protected health information requirements belong to the covered entity and should be put to any platform in a healthcare deployment.

Government: a public agency

Connect reaches policy manuals, regulations, and case files where they live, including systems that cannot be migrated. Secure means need-to-know stays need-to-know, enforced per query and per person. Enrich means finding the section of the regulation that applies to this case, not the regulation. Find means a form number and a plain English question both work, because the public and the caseworker ask in different registers. Ground means every answer points back to the statute, rule, or record behind it. Deliver means every answer and action is on the record for oversight, a baseline expectation in public-sector work rather than a feature. Authorization regimes such as FedRAMP or StateRAMP are requirements the agency carries, and belong in vendor criteria from the start.

Lucidworks builds for this chain directly. Its approach, the AI Context Data Platform, is designed so the six steps run as one governed path rather than six separately procured tools, with permissions carried from source to answer.

Frequently asked questions

Which step do organizations most often skip?

Secure, because it is invisible until it fails. The other five produce visible symptoms in a pilot: missing sources make answers incomplete, bad chunking returns unhelpful documents, and ungrounded answers eventually get caught. A missing or post-filtered permission model produces answers that look perfect, because they are correct; they are just correct from content the person asking had no right to see. Nothing in the output signals the problem, so it survives the pilot.

Can we do these steps with tools we already own?

In parts, yes. Most enterprises already have connectors, an identity provider holding group memberships, a search engine, and access to embedding models. The hard part is not acquiring the pieces; it is making them work as one chain rather than six disconnected projects. Permissions have to survive the handoff from ingestion to retrieval, passage boundaries the handoff to ranking, and provenance the handoff to generation. Those seams are where assembled stacks break.

Is this just RAG with more steps?

Retrieval-augmented generation (RAG) is one way to implement steps four and five. The six-step model covers what has to be true before retrieval is trustworthy and after an answer is produced, which is where governed deployments fail. Rather than stuffing retrieved text into a prompt in advance, agents increasingly pull context at runtime through tool calls, making per-query permission checks and per-call logging more important, not less.

How is a context layer different from a semantic layer or a knowledge graph?

A semantic layer defines business meaning over structured data: metrics, dimensions, and joins. A knowledge graph models entities and relationships. A context layer is the broader category that constructs, governs, and delivers reusable context to AI agents at runtime, roughly how Gartner’s August 2026 “Market Overview for AI Context Platforms” defines it. The practical difference is coverage: semantic layers and graphs sit over structured sources, while most enterprise knowledge, and nearly every access-control problem, lives in unstructured content. Forrester frames the context layer as the next evolution of semantic layers and knowledge graphs.

How do we prove to an auditor that an answer was grounded?

You need three records tied together: the question and the identity it was asked under, the exact passages retrieved and the entitlements enforced at that moment, and the answer with its citations. Missing any one makes the reconstruction a guess rather than evidence. Ask a vendor to demonstrate this on a specific past query, not a fresh one: reproducing an answer today is not the same as showing what happened six months ago.

Where should we start if we cannot do all six at once?

Start with Connect and Secure together, and resist deferring Secure. Retrofitting permissions onto a working retrieval system means rebuilding ingestion, because entitlements have to be captured with the content rather than bolted on afterward. Enrich, Find, Ground, and Deliver can be improved iteratively on a correct foundation. The first two cannot be improved into correctness later.