Give ChatGPT company knowledge: choose the right source route

First decide whether ChatGPT needs a selected snapshot or a way to retrieve changing sources. The right route depends on the task, your workspace and the access you can actually verify.

Start with the job, not an API key

You want ChatGPT to answer a question about a company procedure. That can mean supplying a selected document, using a connection already approved for the workspace, or building an integration. Those are different operations. A model-provider API key is not a universal switch that connects every ChatGPT or Claude application to company sources.

This is a route-selection guide, not a claim that a connection has been installed or tested. Availability and administrator controls must be checked in the workspace where the work will happen.

A snapshot and a connection solve different problems

For a bounded task, an authorized, selected document can be enough. Treat the supplied material as a snapshot: someone needs to replace it when the source changes, and its sharing and retention need to match the task. Pasting or uploading is not categorically forbidden, but it is not automatic synchronization of the source’s future permissions either.

For changing knowledge, consider a supported connection that can retrieve current evidence under an appropriate identity. Determine whether it uses live queries, an index or both. A connector label alone does not establish freshness, access boundaries or which copies remain after disconnection.

For custom development, keep the interfaces distinct. OpenAI documents attached knowledge and REST-based Actions for custom GPTs. Its plugin documentation separately describes MCP tools and company-knowledge compatibility. These are not interchangeable configurations. GPT Actions documentation · MCP plugin tools documentation

A fictional question, source and answer

Imagine a team asks: “What should I include when requesting a laptop replacement?” The authorized source is IT guide I4, revision 3: “Include the device asset tag, a description of the fault and your delivery office. The IT team reviews the request before approving a replacement.”

Whether that passage comes from an approved snapshot or a connection, a useful prompt is: “Answer using IT guide I4. List the required information, cite the source, and say whether it specifies an approval deadline.”

Expected illustrative answer: “Include the asset tag, fault description and delivery office. IT reviews the request before approval. I4 revision 3 does not state an approval deadline.” The answer should not invent a two-day turnaround or claim that submission guarantees a replacement.

The real acceptance check is to open the cited source and confirm that the passage supports the answer. A citation is a route to evidence, not a guarantee that the model interpreted it correctly.

Follow the data in both directions

A retrieval request goes from the client to the connected service. Relevant source text comes back and becomes available to the answering system. Keeping the original document in its source does not mean no content is transferred for processing.

Check the client’s applicable data settings and provider terms, the integration’s access scope and any retained index or conversation copies. Using your own key does not, by itself, determine every downstream system’s retention or training policy.

For a custom MCP implementation, OpenAI’s documentation describes read-only search and fetch compatibility and user-openable source URLs. It also states that tool annotations do not replace server authorization. That is an implementation obligation, not something a prompt can prove. Company knowledge compatibility

Try one allowed question and one boundary case

Begin with harmless approved material like I4. Then ask about a topic absent from the source and check that the answer identifies the gap. Where a connection has different user scopes, use authorized test identities and harmless test records to verify that a denied source is not disclosed.

Do not infer that every connected employee has the same access, or that an access log proves nothing was ever exposed. Preserve the distinction between the current source, a retrieved excerpt, a saved conversation and a persistent summary.

For a protocol-level example, see a knowledge base through MCP. For reviewing individual factual claims, see the company-data answer check. Expand only after the first source-to-answer path is useful and understandable.

About this article

Written by the HeyBrain Editorial Team with AI assistance. The examples are fictional and illustrate design choices; they are not customer stories, product demonstrations or measured test results. Primary sources are linked beside the claims they support.