Start with local AI and add data sources deliberately? The AI Cube provides Open WebUI, a local model, and knowledge spaces. We connect Nextcloud, SharePoint, DMS, and business systems separately after assessing interfaces and permissions. Explore the RAG Proof of Value · See the internal assistant · Explore the AI Cube
An AI chat over company knowledge sounds simple: read files, split them, create embeddings, and search. This approach is known as retrieval-augmented generation (RAG). In production, the lifecycle matters more than the first import. New versions, deleted files, changed sharing, and disabled users must reliably propagate to the index.
Two distinct starting points
Manual knowledge spaces
Open WebUI manages files and collections as knowledge. Users or authorised teams upload selected documents and use them in chat. There is also a file picker for OneDrive/SharePoint and Google Drive; it creates a copy and does not synchronise. This fits constrained collections, pilots, and content intentionally maintained in Open WebUI.
Synchronisation with oikb
Since Open WebUI 0.9.6 there is an official sync tool, oikb (documentation). It connects Nextcloud via WebDAV and an app password and SharePoint via an Entra app with a client secret or certificate, and keeps knowledge spaces current on a schedule, including deleted files. For these two sources, retrieval, changes and deletion are solved without custom development.
Permissions remain open: oikb works with one service account in the source and one Open WebUI user. Creating knowledge spaces per department folder and granting them to groups in Open WebUI gives separation at folder level. oikb does not reproduce per-document permissions.
Automated data sources with a dedicated pipeline
If Nextcloud, SharePoint, or a DMS remains the system of record and per-document permissions must apply, the AI needs a dedicated synchronisation pipeline. It reads approved areas, handles changes incrementally, and carries source, version, permissions, and deletion state as metadata.
This is not a hardware switch. It is a separate software and permission task.
Data path of a RAG pipeline
- retrieve files and metadata through a documented interface;
- distinguish new, changed, moved, and deleted objects;
- extract supported formats with controlled parsers;
- split content into useful retrieval units;
- map users, groups, or tenants from the source and enforce access before vector search;
- update embeddings and versioned metadata;
- filter by permission before retrieval;
- connect answers to source passages and versions.
Nextcloud
Nextcloud exposes files through authenticated WebDAV and provides properties including file IDs, modification time, and permission information. A dedicated technical account with minimal scope is used for integration. Public share links are generally unsuitable for a controlled enterprise index.
Identity mapping remains essential. A service account may read content for indexing, but search must apply the signed-in user's rights. Importing everything with a privileged account does not solve that requirement.
The detailed guide to connecting Open WebUI and Nextcloud compares the three paths oikb, Nextcloud-native and a dedicated retrieval service, and covers identity handover, ACL metadata and the filter in the vector database.
SharePoint and Microsoft Graph
Microsoft Graph exposes sites, document libraries, DriveItems, and permissions. The application registration receives only necessary rights, with Sites.Selected even for selected sites only. Large estates need change queries via driveItem delta, stable object IDs, and a traceable mapping to Entra ID groups.
Sharing links and inherited permissions are more complex than a folder list. Define included sites and verify whether item-level rights can be reproduced before implementation.
DMS and professional software
A DMS connection depends on its API, export facilities, metadata quality, and permission output. Periodic full exports are simple but slow and poor at deletion. Webhooks or change feeds are better when provided reliably.
If a source cannot expose permissions in machine-readable form, constrain scope to generally approved collections, maintain an explicit access mapping, or do not implement the integration. The model must never decide what a user may see.
Product foundation and project scope
The AI Cube provides the local platform with Open WebUI, a model, and manual knowledge spaces. For automated sources, WZ-IT scopes the right path as a separate project: synchronisation with oikb and group rights per knowledge space, or a dedicated pipeline with connector, parser, vector store, access filter, monitoring, and deletion process. This keeps the base product quick to deploy while fitting the integration to the real system estate.
Acceptance criteria
- new documents become searchable within the agreed interval;
- a new version replaces old content traceably;
- deleted or withdrawn content disappears from retrieval and answer context;
- users with different rights receive different results;
- answers expose source and document version;
- parser, synchronisation, and stale-index failures are monitored.
