HUL's supply chain teams across India and Southeast Asia were losing 2+ days to locate compliance documents, supplier specs, and process documentation spread across 12 internal systems in different formats and access levels. Knowledge was siloed by region, function, and seniority.
Enterprise supply chain at scale, across a large organisation and its existing systems. Relevant to any supply chain rollout where adoption, not configuration, is the risk.
Hindustan Unilever Limited operates one of the most complex supply chains in Asia - thousands of SKUs, hundreds of suppliers, manufacturing sites across multiple countries, and a regulatory surface that spans 8 different jurisdictions. Within that complexity, institutional knowledge is both an organisation's greatest asset and its most fragile one. At HUL, a question about a supplier specification, a compliance document, or a process standard could take 2+ days to answer - not because the answer didn't exist, but because it was buried somewhere in Confluence, SharePoint, a regional SharePoint instance, or a legacy proprietary database that only two people knew how to search. The cost wasn't just the 2-day wait. It was every decision made without the right information.
The obvious starting point was to build a search engine. We argued the starting point had to be access control architecture. A knowledge assistant that surfaces documents a user isn't authorised to see isn't a useful tool - it's a compliance incident waiting to happen. We spent the first three weeks mapping HUL's existing permission structures across all 12 systems, designing a unified RBAC model that could express the combined access rules from Confluence, SharePoint, and the proprietary databases in a single enforcement layer. Only once that architecture was validated by HUL's security team did we begin indexing documents and building the retrieval layer.
The system is a RAG-based knowledge assistant running entirely within HUL's Azure tenancy. A custom indexing pipeline crawls Confluence, SharePoint (global and regional instances), and the proprietary procurement database on a nightly schedule, chunking documents into semantically meaningful sections and storing embeddings in Pinecone with rich metadata (department, region, document type, effective date, access tier). The retrieval layer enforces per-user access control at query time - every retrieval request is filtered against the user's Azure AD groups before any document chunk is returned. The response generation layer uses GPT-4o with a strict citation prompt: every sentence in a response must reference a specific document chunk, and the answer includes clickable links back to the source document in its original system.
Custom connectors for Confluence Cloud API, SharePoint REST API (three tenancies), and a proprietary procurement database via direct DB read replica. Documents are chunked by semantic section, enriched with metadata (region, department, document type, effective date, access tier), and embedded with text-embedding-3-large. Nightly freshness checks flag modified documents for re-indexing.
Every Pinecone query is filtered at retrieval time against the querying user's Azure AD group memberships, mapped to HUL's document access tier structure. A user in 'India Sourcing' cannot retrieve documents tagged 'SEA Compliance Restricted' regardless of search intent - the document is invisible at query time.
GPT-4o generates answers under a strict prompt contract: every factual claim must cite a specific retrieved chunk by ID. The response renders inline citations with clickable deep links back to the source document in its original system - Confluence, SharePoint, or the procurement portal.
When a source document is updated, the old version's chunks are deprecated in Pinecone and new chunks are indexed with an incremented version tag. If a user asks a question and the most relevant document was updated in the last 7 days, the response includes a freshness notice - preventing decisions based on recently superseded content.
Every query, every document retrieved, every response generated, and every user access event is logged to Azure Monitor with the user's identity, their AD group memberships at query time, and the document access tier of each retrieved chunk. HUL's compliance team has a real-time dashboard of all knowledge assistant activity across all 8 countries.
The 4.2-minute average resolution time is the headline. The operational shift underneath it - from knowledge as a bottleneck to knowledge as an accelerator - is the real outcome.
Query resolution time dropped from 2 days to 4.2 minutes. 15,000+ users across 8 countries. Zero data security incidents. Document access compliance at 100%.
Before this, a compliance question could take two days to answer across three email chains. Now my team gets the answer with source citations in under five minutes. The access control architecture gave our security team full confidence from day one.
We scoped permission mapping as two weeks of work. It took five. HUL's access structures had evolved organically over a decade - different regions had different SharePoint permission models, Confluence had space-level and page-level restrictions in conflict with each other, and the procurement database had a bespoke access model that had never been formally documented. Mapping this comprehensively before indexing any content added time to the project but prevented what would have been a serious compliance incident if we'd shipped fast and corrected later.
In the first month after launch, two users received responses citing documents that had been updated since the last index run. Neither was a compliance issue, but both eroded trust. We moved freshness monitoring from a nightly batch job to an event-driven pipeline that detects document edits via webhook (Confluence) and change notification (SharePoint) and re-indexes within 2 hours. The lesson: in regulated environments, knowledge freshness is as important as knowledge accuracy.
Top-down endorsement from the digital transformation programme secured the budget but didn't drive adoption. What drove adoption was team leads in each region actively using the tool in team meetings - demonstrating that 'ask the assistant first' was a behaviour change they personally endorsed. We ran four regional launch sessions with team lead demonstrations, and adoption in regions where a team lead participated was 3× higher at 30 days than regions where we only sent onboarding emails.
More work
