# Even better answers behind login

A public chatbot can only answer what is public. But the most valuable answers usually lie within – in the intranet, in internal procedures, in member benefits and customer-specific agreements. CoreAI lets you open exactly that door, safely: behind login, the knowledge base fetches from internal sources you otherwise can't reach, and shows only what each individual user is actually meant to see – as an employee, member or customer.

Same interface, whether the user is anonymous or logged in. But the answers become deeper, more precise and more personal the moment the user is logged in.

## Role-based answers from intranet and internal documents

Behind login, the knowledge base expands to the internal sources the user has access to. Out on the open website the knowledge base answers from the public content; logged in, the user also gets procedure descriptions, HR handbooks, membership terms, price lists or customer-specific agreements.

Technically this happens by scoping each request to a defined set of sources and documents. CoreAI limits the search in the knowledge base to exactly that set, so an employee gets answers from internal handbooks, while a logged-in customer only sees their own agreements. Two users can ask exactly the same question and get different – but correct – answers, based on what they are allowed to see.

## Login against your own system – with token validation

CoreAI validates the user against your own login system instead of building yet another user registry you have to maintain.

Here's how it works: when a logged-in user opens the knowledge base, the user's token is sent to a validation URL you configure. CoreAI supports both a token in the URL itself and a token as a Bearer in the Authorization header. Your system responds whether the token is valid – and can at the same time return user information such as name, email and expiry time.

If validation succeeds, the user is let in. If it fails – invalid, expired or missing token – access is denied. And if a knowledge base is set up as protected, every unauthenticated attempt is rejected. You keep full control over who is who, in the system you already trust.

## The agent acts only within the user's permissions

The AI cannot "stumble" over information the user isn't meant to see. The access boundary is set not by the AI, but by you – and enforced at the data level.

Once the user is validated, your system decides which sources and documents that role should have access to, and CoreAI limits all retrieval to exactly that set. The rest of the knowledge base is simply not visible to the search. The knowledge base therefore cannot leak internal documents to a customer, or one department's procedures to another – because they never enter the search basis for that user.

In addition, the knowledge base can be set to answer exclusively from your own sources, so it doesn't fall back on general knowledge when the answer needs to be grounded in internal facts.

## Several knowledge bases with different access

For an optimal setup we recommend at least four knowledge bases, each scoped to its audience:

- **Public:** open content for anonymous visitors on the front page, just like an ordinary customer-service chatbot.
- **For customers:** customer-specific agreements, terms and prices, visible only to logged-in customers.
- **For suppliers:** agreements, procedures and content aimed at your suppliers.
- **For employees:** intranet, HR handbooks and internal procedures, for logged-in staff only.

## What this means for the business

### More value from the content you already have

The internal documents that today lie hidden in folders and the intranet become searchable and useful – for the right people.

### Security without compromise

Access is governed by your own login system via token validation, and the AI fetches only from what the user has the right to see. No new user database, no parallel access management.

### Lower threshold, higher self-service

Employees avoid searching through the intranet, and logged-in customers get answers about their own circumstances – without contacting support.

## In summary

Behind login, CoreAI goes from being a public answer service to becoming a personal, role-aware knowledge base. It validates the user against your own system, expands the knowledge base to internal sources, and fetches only within the user's permissions – all through the same interface that serves customers outside.

One interface. The right knowledge base. Only what the user is meant to see.