A knowledge management strategy is a plan for how a company's information is stored, structured, kept current, and made findable. It has become a precondition for AI rather than an administrative nicety, because an AI agent answers from whatever it can read. If the readable material is outdated, duplicated, or scattered, the agent's answers inherit every one of those faults. The strategy's job is to make the company's stored knowledge match what is actually true.
Clean Data Sources
The first workstream is source hygiene. Company knowledge typically lives across tools such as Confluence, Google Drive, Notion, and Slack, and each accumulates stale pages, duplicate copies, and drafts that read as authoritative. Cleaning means three concrete moves: declaring a single source of truth per topic, archiving superseded documents rather than leaving them findable, and marking ownership so every living document has someone responsible for its accuracy. An AI retrieval system cannot tell a current policy from its 2022 predecessor by looking at it. The structure has to tell it.
My SOP thesis, from coaching hundreds of founders: every solo founder hits the same wall, and it's not funding or product-market fit. It's the moment they realise their entire business lives inside their head, and the business can't grow until you get it out. Knowledge management strategy is that problem at company scale. The scattered files in Confluence and Drive are the symptom. The cause is that nobody ever extracted the tacit stuff, and my favourite way to start is blunt: point an AI at all your meeting transcripts and ask it to write the handbook of all the unsaid things about how you work. That draft is wrong in places, and correcting it is the fastest knowledge audit you'll ever run.
Access Control and Security
An AI agent with broad document access will answer any question its documents can answer, including ones the asker should not have asked. Access control for AI therefore mirrors the permissions people already have: the agent retrieves only from documents the requesting user is entitled to see, enforced at query time rather than assumed at setup. HR records, salary data, and financial details are the standard failure cases, and they are also personal information governed by the Privacy Act 1988, which makes a leak through an AI answer a compliance event, not just an awkward one. Permission-aware retrieval is the mechanism that keeps a helpful agent from becoming an internal disclosure engine.
What we actually find in audits is worse than a permissions gap: whole teams using multiple AI tools on personal accounts, no structure, no shared learning, and company information flowing through accounts the company doesn't control. One science team we audited was doing exactly this. So sequence it properly: before you tune retrieval permissions, get the ungoverned usage inside the tent, because the biggest leak isn't your AI answering the wrong staff member. It's your staff answering to someone else's AI.
Clear Workflows
Knowledge decays at the speed the business changes, so a strategy that depends on periodic manual cleanups fails by default. Sustainable upkeep is built into the flow of work: documents carry review dates, owners are prompted when their pages go stale, and high-change material such as pricing or policy is generated from the system of record rather than retyped into documents. The measure of a good upkeep workflow is that accuracy holds without a dedicated person spending their week on it.
I'll offer our own scar tissue here. We run file-based memory across our agent systems, and we've watched it decay in exactly the way this section warns about: daily notes piling up, the index going stale, relevant context not loading when it should. The fix that held wasn't a better tool, it was declaring one canonical source and making everything else read from it, then wiring upkeep into the flow of work. If we, an AI company running on this stuff daily, have to actively fight knowledge rot, your Confluence doesn't stand a chance without designed upkeep. Assume decay. Build the workflow that fights it.
Measurable Value
The value of knowledge work shows up in the systems that consume it. The usable metrics are answer accuracy on a fixed test set of real staff questions, the share of AI answers that cite a current source, time-to-answer for common lookups, and the volume of repetitive questions that stop reaching subject-matter experts. Measured before and after a cleanup, these numbers turn knowledge management from a faith-based project into an operational one with a baseline.
The value case can be very concrete. Clients tell us reporting is the worst part of the job, roughly a week to collect and format data that already exists somewhere in the business. That week is a knowledge-management failure wearing a reporting costume. And the market prices this work seriously: one client's first engagement with us, $25K, was entirely shared knowledge infrastructure, nothing flashier, because once it's explained, people instantly recognise the scattered-knowledge problem as theirs. Michael's post-audit notes say the company brain is the thing that consistently gets the "I really want this" reaction. Measure the before-state properly, hours to answer, hours to report, repeats reaching your experts, and the after-state sells itself.
What They Ignore
Practitioners setting up AI-ready knowledge skip three kinds of material, and the pattern is instructive. Records-management theory built for paper and library classification does not transfer, because retrieval systems search meaning rather than filing codes. Abstract frameworks without steps for the actual tools in use cannot be executed. And deep engineering guides aimed at search infrastructure builders solve a different problem from the one an operations team has, which is making existing content trustworthy. What survives the filter is specific: which sources to clean, in what order, with what ownership.
Right to ignore all of it. The test I'd apply to any knowledge-management resource is the same one I apply to our own: does it survive contact with your actual tools this week? Records-management theory doesn't. A step list for cleaning your real Drive does. The one habit I'd add that no framework mentions: write the messy version down anyway. My investor updates were never the polished kind, and every major opportunity in my career came from them. Same for internal knowledge: a rough, honest, current document beats a beautiful stale one every single time an AI or a human reads it.
Related reading
References
- Privacy Act 1988 (Cth), Federal Register of Legislation - https://www.legislation.gov.au/C2004A03712/latest/text
- Internal systems named on this page (triage, monitoring, dashboards, pipelines) are Hourglass internal tooling, not public. Class-b author-authority links (third-party press/podcast for Batko/Fin): OPEN - source at Pass 5.
Common questions
How do AI agents actually work?
An agent pairs a language model with tools and rules. The model interprets the input and plans steps, the tools let it act, querying a database, calling an API, writing a record, and the rules bound what it may do alone versus what waits for approval. Every action lands in a log, and good systems feed human corrections back into behaviour.
How to use AI to automate business operations?
Give AI a role, not a licence: define one job, triaging the inbox, chasing receivables, screening candidates, connect it to the systems that job touches, and hold it to the same standard as a hire, defined outputs, supervised start, measured results. Role-shaped automation beats general assistants.
What can I automate with AI agents?
Whole roles' routine layers: the bookkeeping keying, the recruiter's screening and scheduling, the receivables chasing, the support tier-1 queue, the SDR research and first touch. The judgement core of each role stays human; the volume around it is automatable now.