RMZ

Azure AD OAuth 2.0 authentication with JWT-backed sessions. Real-time Graph API permission validation runs on every query, with a 5-minute TTL cache balancing responsiveness against load. Permission filtering runs before retrieval, so out-of-scope documents never enter Claude's context window. PostgreSQL holds audit logs and ID-to-URL metadata mappings, and Traefik fronts the deployment as a secure reverse proxy.

Existing document permissions had to be respected exactly. Convenience was not a reason to show anyone a file they were not entitled to see.

Intent classification with Claude routes each query down the retrieval-grounded or direct-generation path. Grounded answer generation has Claude synthesise from retrieved chunks under instructions to remain within source material and attribute every claim. Structured-source reasoning parses Excel and CSV rather than treating them as prose, passing Claude data it can reason over numerically. Multi-turn context lets users ask follow-up questions naturally, with Claude carrying the thread.

Automated file discovery across target SharePoint sites and OneDrive for Business accounts. Format validation and semantic chunking tuned for long-form enterprise documents. Deduplication and version tracking, so superseded drafts do not compete with current ones. Timestamp-based incremental sync keeps the index current without full reprocessing.

The pipeline exists to serve Claude clean, current, correctly scoped context at the moment a question is asked. Retrieval quality sets the ceiling on answer quality, and no amount of prompt engineering recovers from feeding the model the wrong three documents.

A confident but unsourced answer about an internal policy or a contract term is worse than no answer at all, because it will be believed.

Claude does the reasoning work across the entire assistant. Every incoming question passes through Claude for intent classification, which determines whether it should be answered from retrieved documents or handled directly. Where retrieval applies, Claude synthesises the response from the returned chunks under prompt constraints that keep it inside the source material and require attribution for each claim. Where the source is a spreadsheet rather than a document, Claude reasons over parsed tabular data instead of prose.

An assistant that answers well but cannot show its working is difficult to trust and impossible to audit. Constraining Claude to retrieved context and requiring attribution turns a fluent answer into a checkable one, which is what allowed the platform to be considered for material that carries real consequences when it is wrong. Claude for Teams supports the human side of the rollout, giving champions and pilot users a working environment during enablement.

Stack: Claude API · Claude for Teams · Python · Microsoft Graph API · Azure AD / OAuth 2.0 · PostgreSQL · Pandas · Traefik

Phase 1 · Foundation & access. Azure AD app registration, OAuth 2.0 scope approval, Graph API connectivity, environment provisioning, PostgreSQL and Traefik setup, security review sign-off.

Phase 2 · Ingestion pipeline. File discovery, format validation, semantic chunking and indexing, deduplication, incremental sync.

Phase 3 · Assistant & retrieval layer. Claude-based intent routing and answer generation, structured and unstructured retrieval paths, citation rendering, multi-turn context, query-time permission enforcement.

Phase 4 · Pilot & hardening. Limited business-unit pilot, retrieval-accuracy and permission-leakage testing, prompt and latency tuning, audit-log validation.

Phase 5 · Go-live & enablement. Production cutover, champion training, support-handover runbook, adoption tracking and feedback loop.