Certified Lie: When Corporate AI Answers from an Incomplete Horizon

The article describes an overlooked risk of enterprise AI assistants built over internal documents: not data leakage (oversharing) but undersharing — the assistant answers from an incomplete horizon and backs the answer with a truthful citation, producing a "certified lie": a factually wrong answer with impeccable sources. The author argues that the center of gravity of enterprise RAG failure lies not in the model but in authorization, and proposes three artifacts that must be finished before licenses are purchased: a content contract with four visibility modes, silence rules with calibrated abstention and disclosure of the horizon, and written commitments to employees. The text grounds its argument in work on Permission-Aware RAG (IEEE Access 2025), Microsoft documentation, the German BAG decision 1 ABR 20/21, Art. 26(7) of Regulation (EU) 2024/1689, and § 316 of the Czech Labour Code, and notes the parallel with cover stories in multilevel-secure databases.

One morning, a senior salesperson at a mid-sized company asks the in-house AI assistant whether they can offer a key customer a ten-percent discount. The assistant says yes and attaches a citation: the valid price list, a specific document, the correct revision number. A week later it turns out that three days earlier a new sales directive had come into force, one that rules out any discount for this particular customer. The assistant did not know about it. It was not allowed to see it — the directive sat in an area its permissions do not reach.

The scene is constructed, but it is a type; it does not describe a particular incident, it describes a class of incidents. Nobody in it lied. The price list was genuine, the citation was accurate, the model did not hallucinate. And yet the company acted on an untruth — because the right document was out of reach and the assistant, instead of admitting its blind spot, confidently answered from whatever it happened to see.

Public debate about corporate artificial intelligence revolves around two questions: which model is best, and whether data will leak out. Both are legitimate. Both, however, miss the risk that is worse precisely because it is quiet. It is not what the assistant discloses, but what it cannot see — and the more convincingly it covers up that invisibility, the more expensive the decision that arises from its answer may be.

Deploying a language assistant over corporate documents is therefore not a model project but a governance one. The decisive work has to happen before the first licence order is placed, and it consists of three things you cannot buy in any product: a contract about what the system may search, order in access rights, and rules for how to own up when the system does not know or is not allowed to say. Why now? Because assistants are spreading through Czech companies faster and faster, obligations under the European AI Act are phasing in, and almost nobody here writes about the flip side — about what happens when the assistant cannot see enough.

The leak risk is well mapped and there is mature equipment for it. In the Microsoft ecosystem this means sensitivity labels, assigned to a document either manually at creation or automatically by pattern; data loss prevention (DLP) policies, which can exclude labelled content from Copilot entirely; and a mechanism by which an answer inherits the strictest label from all the sources it relies on. According to Microsoft's documentation, Copilot does not summarize excluded content but may refer to it — it shows that a document exists without revealing what is inside. All of this is well thought through, and in practice it works.

It has one limitation: it points in a single direction. This whole apparatus addresses oversharing: the situation in which someone who should not gets to sensitive content. But access rights have two edges. When the permission list filters out a document that belongs in the answer but that the user is not allowed to see, the system does not fall silent. It answers from what is left, and backs the answer with a citation that holds up. The result is something for which we have no established word; I will call it a certified lie — an answer that is factually wrong, but in which every citation checks out, because the document that would have corrected it was denied at the input.

That this is not a theoretical construct is shown by academic work. Jooyoung Jeong and Sang-goo Lee of Seoul National University built a framework for permission-aware RAG in the journal IEEE Access (2025) and, among other things, measured how the level of access affects answer quality. The result can be summed up in one sentence: the more relevant content is denied to the user, the worse the system answers — measurably so. Companies fear oversharing because it is visible: a document leaks, an alarm goes off. Undersharing is worse, because it is not visible. It manifests not as an alarm but as a calm, wrong answer that nobody questions — "it has a citation, doesn't it."

From this follows the first of the three artifacts that must be finished before deployment. I call it the content contract: a binding, internally published document describing what the knowledge system searches, in what mode, what it never searches — and what the parties promise each other. It is not a security policy written for an auditor. It is a text every employee must be able to understand, because without people identifying with it, the system has technology but not legitimacy.

Its backbone is four visibility modes. In the first, the content is not in the system at all; the assistant knows only where to point ("you will find invoices in the ERP"), while the data itself lies beyond its reach. In the second, the content is accessible only to members of a specific case or engagement: such a bid is seen only by the team working on it. In the third, access follows role and department; this is the ordinary backbone of operations. In the fourth, the content is freely available to all employees and forms the canonical layer — a single source of truth for company-wide rules, from holiday entitlement to signing authority.

A catalogue of categories is then sorted into these modes. Salaries, performance reviews and employees' health restrictions belong in the first mode and have no business being in the corpus at all. So do costings and margins, because they are competitively critical. The org chart, the phone directory and the home-office rules, by contrast, belong in the fourth — and are paradoxically the most useful thing the assistant can do, because they dispose of the majority of queries. The essential point is that classification is not universal. A production recipe is ordinary technology for a toothbrush manufacturer, but for a pharmaceutical company it is the core of protected knowledge, and for an explosives manufacturer it is something that does not belong in the system even as a mention. That is why the contract has industry profiles, and in them a so-called ratchet rule: a profile may only tighten any category, never loosen it. Loosening below the catalogue baseline can be approved only by a designated person or board, case by case, in writing, and for a limited time.

This logic is not new; it is merely being carried over into a new medium. It is the same mechanism as the classified-information regime: the originator declares the document's classification level when it is created, and that level is inherited downstream. Sensitivity labels in Purview do the same thing inside the product, and inheritance of the strictest label into the answer is exactly what the content contract calls derived classification. The difference is that the contract carries this mechanism out of the configuration console, to people, and adds something the product itself does not address: rules for how to behave when the system runs into its own boundary.

The second artifact is the rules of silence. A well-built assistant has three possible outputs for every query, not one. Either it answers. Or, instead of answering, it shows documents and leaves interpretation to a human. Or it stays silent — but silent out loud, with a pointer to where to go or how to request access to the information or data. The last is the hardest and the most important, because it runs against the model's training: language models are steered to always answer something, and the ability to say "I cannot see enough for this" has to be literally forced into the system.

Two further things belong here. The first is calibrated abstention: the system refuses synthesis where its horizon is incomplete, instead of computing an answer out of what is left. The second is ongoing disclosure of that horizon — a kind of banner above every answer along the lines of "answering from the sales and engineering perspectives; out of reach: legal and HR". The user then knows how large a share of the puzzle the answer rests on, and does not get a smooth sentence built over an empty space without knowing that the emptiness is there.

One subtlety separates a good system from a dangerous one. For most content it is legitimate and useful to answer "the document exists, you do not have access to it". For some categories, however, even the existence is sensitive — with an internal investigation or a planned acquisition, even a bare "there is something here" gives away too much. There the system must behave identically whether the document exists or not; this is governed by a special flag the originator sets when creating it.

The third artifact aims somewhere other than at technology — at the people the system concerns. Here a look abroad is instructive. In Germany, employee participation in the introduction of such systems is enforceable. Under Section 87(1) no. 6 of the Works Constitution Act (BetrVG), the works council has a co-determination right over technical devices objectively capable of monitoring employees' conduct and performance — and the employer's subjective intention is irrelevant. The Federal Labour Court (BAG), in its decision of 8 March 2022 (case no. 1 ABR 20/21), confirmed that the introduction of Microsoft 365 also falls under this provision, because it objectively has such capability. Legal commentary has since argued that the same reasoning applies to Copilot all the more strongly: the depth of its processing opens up even broader evaluation possibilities than plain office applications.

The European AI Act (Regulation 2024/1689) adds its own layer. Under Article 26(7), an employer deploying a high-risk AI system in the workplace must inform workers' representatives and the affected employees before it is put into service. The timing, however, needs to be read carefully. The applicability of the obligations for high-risk systems under Annex III — where Article 26 belongs — was pushed by the Digital Omnibus compromise package from the original August 2026 to 2 December 2027; as of summer 2026, the amendment was awaiting publication in the Official Journal. The obligation therefore exists; its deadline is simply not yet running. Note the scope as well: it applies only to systems classified as high-risk, which an ordinary knowledge assistant need not be in itself — it is the use, for instance assessing employees, that puts it in that box. And this is exactly where the circle closes. The promise that queries will not be used to evaluate people is not merely an ethical gesture; it is at the same time a design decision that keeps the system out of the strictest regulatory pigeonhole.

Czechia is poorer than Germany in this respect. We have no co-determination veto; Section 316 of the Labour Code imposes on the employer proportionality and a duty to inform: it may monitor the use of work equipment, but must not, without serious grounds consisting in the special nature of its activity, invade employees' privacy through surveillance, and if it has such grounds, it is obliged to inform employees directly of the scope and manner of the monitoring. No right for people to co-decide on the introduction of a system follows from that, however. All the more important, then, that the company impose a written contract with its employees on itself voluntarily — and build it on three promises that together make the difference between a tool and an apparatus of surveillance. No silent lie: when the system answers from an incomplete horizon, it says so. No secret searching: it searches only what is in the catalogue, and the catalogue is internally public. No evaluation of people from their queries: what you ask about does not serve to assemble your employee profile.

Only when the three artifacts are finished does technology come in — and there, too, the order matters. First, an inventory of access rights. For years companies let permission lists and group memberships balloon; shared folders accessible to "almost everyone" are the rule, not the exception. As long as the access model is broken, it is unwise to let an assistant loose on it, because the mess will not disappear, only be amplified: what previously someone had to hunt down laboriously in a labyrinth of folders now comes out in response to a one-sentence query. The inventory is therefore a gate, not a formality.

Then search without synthesis — letting the system find and return documents, but not yet assemble answers. This phase is where you tune what comes out for whom, and where permission gaps are exposed before they turn into a certified lie. Only after that do you switch on the gate with abstention, and last of all synthesis — and even that only for low-risk classifications. The reason is simple and worth remembering: the centre of gravity of enterprise RAG failure does not lie in the model but in authorization. Indeed, testimony in the antitrust case against Google indicated that when grounding an answer the model relies on only a handful of top-ranked documents — which means the quality of an answer is determined more by what reaches the model at all than by how clever the model is. Badly configured rights and bad ranking directly shape its horizon.

Three serious objections stand against the approach described. The first and strongest: this is over-regulated, the competition will deploy sooner and gain a head start. Let us take it seriously. Yes, the approach described is slower than buying licences and switching on. But the value arrives in the very first phase — an assistant that reliably finds and shows the right document disposes of most of the helpdesk load, and does so without any synthesis at all. Risk, by contrast, arises only in the last phase, with an assembled answer over sensitive content that the user relies on. Phasing therefore does not delay value; it merely separates cheap gain from expensive risk, and releases the latter last.

The second objection: people will help themselves with ChatGPT anyway, so why complicate life with rules. But shadow AI — uploading company documents into public tools outside any control — is an argument for managed deployment, not against it. When a company does not offer a safe route, people find an unsafe one. Rules are not what drives users out; their absence is.

The third: abstention will annoy people, nobody wants an assistant that keeps going quiet. That would hold if the only alternative to an answer were silence. It is not. Between "I answer with confidence" and "I stay silent" lies a whole band — showing documents, pointing elsewhere, disclosing the horizon. The ratio between when the system answers and when it holds back can be tuned like any other parameter; the goal is not a taciturn assistant, but an assistant that does not lie.

The odd thing about all this is that the problem is old. The security databases of the 1990s, built on multilevel classification, ran into exactly this question: what to show a user with low clearance so that they cannot infer, from what they do not see, that there is something they are not seeing. Their answer was polyinstantiation and so-called cover stories — the system served the lower clearance a consistent false world. Formalized lying, built into the architecture.

Today's companies face the same choice, and most handle it in the worst way there is: they do not handle it, because they do not know it exists. An assistant that, instead of admitting a gap, promptly answers from whatever it happens to see is doing the same thing as those old databases, only without any awareness that it is lying. A contract about what the system may know and what it must admit is the difference between an assistant and a risk with a pleasant voice. The salesperson from the opening did not get burned by a bad model or by a data leak. They got burned because their assistant could not manage the four words every decent colleague can: "I can't see that."

Methodological note. This text was written on 9 July 2026; the information is verified as of that date and the situation may change. Legal claims are verified against primary sources: Article 26(7) of Regulation (EU) 2024/1689 per the consolidated text and European Commission materials; the applicability of the obligations for high-risk systems under Annex III (to which Article 26 belongs) is postponed by the Digital Omnibus package from 2 August 2026 to 2 December 2027 — at the time of writing this was an agreed deal awaiting publication in the Official Journal, so treat it as subject to change. The decision of the Federal Labour Court of 8 March 2022, case no. 1 ABR 20/21, and Section 87(1) no. 6 BetrVG per the full text of the decision; Section 316 of the Labour Code (Act No. 262/2006 Coll.) per the consolidated text. The impact of access level on answer quality is documented by J. Jeong and S.-g. Lee, "Permission-Aware RAG" (IEEE Access, vol. 13, 2025, pp. 192819–192835, DOI 10.1109/ACCESS.2025.3628960). The mechanics of sensitivity labels, DLP and inheritance of the strictest classification are described in Microsoft's public documentation (Microsoft Learn). The claim that the model relies on only a handful of top-ranked documents when grounding answers is based on testimony in the antitrust case against Google. The extension of the co-determination argument to Copilot is weaker (secondary) and is presented as such in the text. The term "certified lie" is the author's own.

Transparency of creation:

The concept, structure and editorial line of the article are the work of the author, who prepared the content outline, established the key theses and directed the entire writing process. Generative AI (Claude, Anthropic) was used as a tool for research, for locating primary sources, and for elaborating the author's content outline into prose.

The author edited the outputs continuously, verified the key findings and approved the final wording. No part of the text was published without human review. All factual data were verified against the publicly available sources cited in the text.

This procedure complies with the requirements of Article 50 of EU Regulation 2024/1689 (AI Act) on transparency of AI-generated content. #poweredByAI