27 Mar 2026 AI Engineering 5 min read

Work IQ: grounding agents in organizational context

Microsoft Work IQ grounds Copilot and agents in how an organization actually works: projects, collaborators, documents, patterns. This article explains the difference between a context layer and a data lake, why permissions must be resolved at query time, what CVE-2025-32711 revealed about the remaining gap, and which six checks teams should run before adopting.

Why generic RAG fails inside a company

Most workplace assistants are built the same way. Export the documents, split them into chunks, embed them, store the vectors, retrieve the top matches. For a product manual this works. For the question of what was decided about the Meier account last week it does not. That answer sits in no single document.

It lives at the intersection of a Teams thread, a meeting transcript, two attachments, and the fact that the person asking works in sales rather than legal. Generic RAG treats a company as a pile of text. A company is a graph of people, projects and access rights that changes daily. Retrieval is a real problem, but a secondary one. The harder question is which slice of the organization a question belongs to.

A task arrives — the agent plans its next step. 1/4

What Work IQ actually is

Microsoft introduced Work IQ at Ignite on 18 November 2025 as the intelligence layer behind Microsoft 365 Copilot and its agents. Microsoft names three building blocks: work data from emails, files, meetings and chats; memory of a person's style, preferences, habits and workflows; and inference that connects both to predict a next action. Access runs through Copilot Studio or through APIs for pro-code agents.

None of this is a new data store. Work IQ is a name for the layer above Microsoft Graph and the Copilot semantic index. Graph grants access. The semantic index provides a combined lexical and semantic map of tenant content. Work IQ is the reasoning surface on top. The distinction matters during evaluation: you are not buying an index, you are buying an interpretation of one.

Context layers instead of data lakes

The data lake pattern moves everything into one place first and sorts out meaning afterwards. A context layer inverts this. Data stays where it lives; identity, relationship and permission are resolved at query time. The Microsoft 365 Copilot Retrieval API shows the pattern in practice. It has been generally available since 20 November 2025 and returns text extracts from SharePoint, OneDrive and Copilot connectors out of the same hybrid index that powers Copilot, with no separate vector store to build or secure.

A single query returns at most 25 extracts. Chat and Search APIs entered public preview on the same date, with client libraries for .NET, Python and TypeScript. The trade-off is honest. You give up control over chunking, embedding model and ranking, and you inherit the coverage gaps of the index you did not build. In exchange you stop maintaining a second copy of your company that goes stale and leaks.

Permission boundaries are the product

Results are permission-trimmed at query time against Microsoft Entra ID and carry sensitivity label metadata. Trimming at query time rather than at index time is the load-bearing detail. An index built once encodes yesterday's access control lists. Revoking a folder permission should change what the assistant says within minutes, not at the next full crawl.

Microsoft paired grounding with governance. Agent 365 and Entra Agent ID entered public preview on 18 November 2025 and give every agent its own directory identity, so agent actions become attributable and revocable like a user account. We treat that as the minimum bar. An agent without its own identity cannot be audited, and an unauditable agent has no place near payroll or contract data.

What permission-aware grounding does not solve

Permission trimming answers whether a user may see a document. It does not answer whether that content should influence an answer. CVE-2025-32711, disclosed on 11 June 2025 and rated CVSS 9.3, made the gap concrete. A single email with hidden instructions caused Microsoft 365 Copilot to pull privileged tenant data into a response and leak it, without the recipient ever opening the mail.

The researchers named the pattern LLM scope violation. Every retrieved item was inside the user's permission boundary. The boundary held; the trust model did not. Microsoft fixed it server-side. The second unsolved problem is oversharing. Permission-aware grounding faithfully surfaces the SharePoint site that was opened to the entire organization three years ago. It does not fix that. It makes it legible at conversational speed.

What teams must verify before adopting

Before we recommend an organizational context layer to a client, we check six points. The answers come from the tenant, not from the vendor. Four of them can be measured in an afternoon with a test account and a stopwatch. The oversharing baseline usually cannot, and it is the one that decides whether the project is a six-week integration or a six-month cleanup.

None of these questions concerns model quality. Grounding failures in workplace assistants are rarely reasoning failures. They are configuration failures that a fluent answer renders invisible. A pilot with ten users will not surface them. A rollout to two thousand will, and by then the assistant is already part of the daily routine.

Check	Question to answer
Permission freshness	How long after a revocation does the assistant stop citing the file
Index coverage	Which repositories sit entirely outside the semantic index
Oversharing baseline	How many sites are open to the whole tenant today
Memory scope	Is inferred memory per user and can a user delete it
Agent identity	Does every agent hold its own identity and audit trail
Untrusted input	Is external content marked and kept away from tool calls

The layer will outlive the product name

As of today the developer surface is narrower than the announcement. Retrieval is generally available, Chat and Search are in preview, and the broader Work IQ interfaces announced in November 2025 are not yet a stable contract. Anyone building on them should budget for the interface to move at least once.

Three developments seem likely over the coming year. Organizational context becomes a procurement question rather than a feature, and buyers will ask whose graph an assistant reasons over. Permission freshness becomes measurable and eventually contractual. And the line between context layer and agent runtime blurs, because an agent that acts needs the same grounding as one that only answers.

We are betting on the layer, not on the vendor. The pattern will outlive any single product name: ground in the real organization, resolve permissions at query time, give every agent an identity, and treat untrusted input as untrusted even when it arrives inside the boundary.