# SharePoint Server On-Prem Private AI Layer Blueprint Generator

> Source: https://netray.co/tools/sharepoint-server-private-ai-layer-blueprint-generator
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

Fill in your SharePoint Server environment and export an architecture plan for a private, on-prem AI assistant: components, security controls, rollout and open questions.

## Category

on-prem-ai

## Erp

Microsoft SharePoint Server

## Audience

- CIO
- IT architect
- Security officer

## Tool

**Kind:** template

**Output:** document

**Fields:**

#### Company name

**Key:** company

**Type:** text

**Default:** Acme Precision Ltd

#### System version

**Key:** version

**Type:** select

**Options:**

- SharePoint Server 2016
- SharePoint Server 2019
- SharePoint Server Subscription Edition

**Default:** SharePoint Server 2019

#### Database engine

**Key:** db

**Type:** select

**Options:**

- SQL Server 2016
- SQL Server 2019
- SQL Server 2022

**Default:** SQL Server 2016

#### Hosting

**Key:** hosting

**Type:** select

**Options:**

- On-prem server
- Private cloud
- Air-gapped

**Default:** On-prem server

#### Named users

**Key:** users

**Type:** number

**Default:** 3000

#### Sites or plants

**Key:** sites

**Type:** number

**Default:** 3

#### Main use cases

**Key:** usecases

**Type:** textarea

**Default:** Cited Q&A over quality procedures, engineering specs and supplier documents; summarize long policy libraries; find the current revision of a work instruction.

#### Data that must never leave the site

**Key:** never

**Type:** textarea

**Default:** Contracts, export-controlled drawings, HR files, anything in restricted site collections. Item-level permissions must be preserved.

#### GPU available

**Key:** gpu

**Type:** select

**Options:**

- No GPU yet (CPU only for pilot)
- 1 x 24 GB GPU
- 1 x 48 GB GPU
- 2 to 4 x 80 GB data-center GPUs
- 8 or more data-center GPUs

**Default:** 1 x 24 GB GPU

#### Target go-live

**Key:** golive

**Type:** text

**Default:** Pilot in 8 weeks, production in 6 months

**Blocks:**

#### Context

**Body:** Company: {{company}}
System: SharePoint Server On-Prem, version {{version}}, database {{db}}
Hosting: {{hosting}}
Scale: {{users}} named users across {{sites}} sites
Target: {{golive}}

Goal: add a private AI assistant over the existing system without moving data to a public cloud service and without replacing the system.

#### Use cases in scope

**Body:** {{usecases}}

#### Data that must never leave the site

**Body:** {{never}}

Control: this data is excluded from the index or processed only on {{hosting}} infrastructure, with access logged.

#### Components

**Table:**

**Columns:**

- Component
- Design

**Rows:**

**0:** Data access path

**1:** SharePoint REST API, CSOM and Search service application; change log for incremental sync; no direct content database reads

**0:** Retrieval index

**1:** Local vector plus keyword index with source URL, modified date and ACL principals on every chunk

**0:** Model serving

**1:** Open-weight model on vLLM or Ollama on {{gpu}}

**0:** Tool server

**1:** MCP or HTTP server with search_documents and get_document tools, read-only, results capped and cited

**0:** Identity and permissions

**1:** AD groups resolved per question; claims-based identity; filter at retrieval or query Search as the user

**0:** Audit

**1:** Append-only log of question, user, passages returned and answer; retained per company policy

#### Security controls

**Body:** Security trimming mirrored from SharePoint permissions; service account read-only; no outbound network from the model host when hosting is air-gapped; encrypted index at rest; named data in the never-leave field excluded from the index.

Hosting mode {{hosting}}: when air-gapped, models, containers and packages enter through a hash-verified transfer and no component calls an external network.

#### Rollout

**Table:**

**Columns:**

- Phase
- Scope
- Exit criteria

**Rows:**

**0:** 1. Read-only questions

**1:** Cited answers over a pilot scope for a small user group on {{gpu}}

**2:** Answers verified by process owners; no permission leaks in tests

**0:** 2. Drafts

**1:** Summaries, comparisons and drafted records a person reviews and enters

**2:** Reviewers accept drafts without major edits in agreed share of cases

**0:** 3. Approved actions

**1:** Narrow actions through the supported API with a named human approver

**2:** Every action logged; rollback path tested; sign-off from system owner

#### Open questions for IT

**Body:** 1. Which web applications and site collections are in scope, and do any use unique item-level permissions at scale?
2. Is remote BLOB storage in use, and where do the files physically live?
3. Is Search crawl healthy, and are IFilters for PDF and CAD installed?
4. Which AD groups represent business roles, and how stale are they?
5. What is the support status of your SharePoint version and the upgrade plan?

#### Approvals

**Signatures:**

- IT architect
- Security officer
- System owner

**Notes:** This is a planning document, not a security certification. Component choices (vector store, model size) depend on your pilot measurements; confirm API names and limits against the documentation for your exact version.

## Content

**Intro:** This generator turns a handful of facts about your SharePoint Server On-Prem environment into a structured architecture plan for a private AI assistant. It covers the components, the security controls tied to your hosting choice, a three-phase rollout and the questions IT has to answer before build.

**Sections:**

#### How to use it

**Body:** Enter your system version, database engine and hosting model, then describe the use cases and the data that must never leave the site. The blueprint fills the context, components, controls and rollout sections, and exports to PDF, Word or Excel. Walk through it with your IT architect and security officer, correct the defaults, and attach it to the project request. Change the GPU field to see how the rollout row for phase one reads on different hardware.

**Bullets:**

- Be specific about restricted data: it becomes a design constraint, not a footnote
- Pick hosting first; it sets the security controls
- Keep use cases to three or four for the pilot
- List the people who can approve write-back

#### What the blueprint assumes

**Body:** The design is the same on every on-prem system: a read-only copy or supported API for data access, a retrieval index that carries permissions, a tool server that exposes only approved read actions, an open-weight model on vLLM or Ollama, and an audit log. SharePoint libraries mix scans, Office files and PDFs, so extraction quality shapes answer quality. The components table names the access path for this system, but you must verify the object and API names for your exact version.

**Bullets:**

- Read-only by default
- Permissions mirrored from the system
- Write-back only through supported APIs with human approval
- Everything logged

#### Reading the rollout table

**Body:** Phase one proves the data and permissions work: cited answers over a small scope. Phase two adds drafts that a person reviews. Phase three allows narrow, approved actions through the system's own API. Do not skip phases: most failures come from skipping permission testing in phase one. Exit criteria are examples; replace them with numbers your process owners agree to, such as the share of answers verified correct in a sample of fifty questions.

#### Common mistakes

**Body:** Teams often size the model before they have defined the use case, grant the assistant a powerful service account, or index everything to avoid deciding scope. Another is leaving the open questions unanswered until build starts. Document-heavy: the index, not the GPU, often drives hardware. Use the open-questions section as the agenda for your first IT workshop and assign an owner to each item.

**Bullets:**

- Powerful service account for convenience
- No permission tests with restricted users
- Indexing without scope decisions
- No owner for open questions

**Cta:** Netray designs and runs private AI layers on SharePoint Server On-Prem with your IT team. If you want a second opinion on your blueprint, we can review it with you.

**Faq:**

#### Does this document commit us to buying anything?

**Answer:** No. The generator runs in your browser and exports a plan you can share internally. It is a starting point for architecture and security review, and every default can be changed.

#### Is the plan valid for air-gapped sites?

**Answer:** Yes. Choose the air-gapped hosting option and the controls section adds transfer and network isolation rules. All components in the table run inside the closed network with no external calls.

#### Why does the plan avoid giving model sizes?

**Answer:** Model size and GPU count depend on concurrency, context length and answer quality targets. Measure them in the pilot, then use the sizing calculator for ranges rather than committing to a number early.

#### Can we reuse the plan for another system?

**Answer:** The structure transfers, but the data access path, permission model and open questions are specific to each system. Generate a separate blueprint for each platform and compare them.

## Search terms

sharepoint server ai architecture, sharepoint server private llm plan, on-prem ai blueprint template, air-gapped ai architecture document, private ai layer architecture template, ai assistant security controls template

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json