A company wants an AI agent to answer employee policy questions. What components would you identify before development?

Before building an AI agent for employee policy questions, what should the architecture include—knowledge sources, AI model, retrieval, security, permissions, conversation flow, and escalation to humans?
How do you ensure the agent answers only from approved company policies instead of generating unsupported information?
This discussion explores the architecture and governance decisions developers should make before writing the first line of code.
A useful topic for anyone learning AI agents, RAG, enterprise AI, Azure AI, Copilot, or AI solution architecture.