HMRC: Ask Security
A generative AI chatbot for internal use to allow HMRC colleagues access to HMRC Security Policies, Standards and Guidance.
1. Summary
1 - Name
Ask Security
2 - Description
A generative AI chatbot for internal use to allow HMRC colleagues access to HMRC Security Policies, Standards and Guidance.
3 - Website URL
N/A internal tool only
4 - Contact email
Tier 2 - Owner and Responsibility
1.1 - Organisation or department
HMRC
1.2 - Team
HMRC, Chief Digital and Information Office, HMRC Security
1.3 - Senior responsible owner
Head of Cyber Security Oversight
1.4 - Third party involvement
Yes
1.4.1 - Third party
IBM Accenture Equal Experts
1.4.2 - Companies House Number
IBM - Company number 00741598 Accenture - Company number 04757301 Equal Experts - Company number 06191086
1.4.3 - Third party role
IBM - Front End Development Accenture - Data Sceince, LLM Development, User Research, Power BI Development Equal Experts - Infrastucture build, tool support
1.4.4 - Procurement procedure type
IBM - Technology Services Three Lot 2,3,5 Accenture - DALAS Framework Equal Experts - BD&A4
1.4.5 - Third party data access terms
Ask Security has a very concise use case: Allowing HMRC internal civil servants access to current IT Security Policy documentation and supporting guidance notes. The Security Hub is a closed data hub which houses this specific data.
Tier 2 - Description and Rationale
2.1 - Detailed description
This project will deliver a user front end called ‘Ask Security’ which will be the Single point of contact for all internal HMRC staff to engage with HRMC Security, more specifically allow access to IT Sercurity Policy & Guidance documentation. The project will be delivered in phases with continuous improvement cycles adding new features and automations that provides the user with a seamless engagement. The benefits will be released as each new feature is released beginning with 24*7 access to Security Guidance based on policies, using a generative AI Chat bot. This project links with the Security Front Door (SFD) project in that it will use the forms and automations within ServiceNow once they have been built and deployed by SFD.
2.2 - Benefits
Multiple entry points into HMRC Security services with varying Service Level Agreements (SLAs) and consistency of responses. Additionally,users report it is not always straightforward to identify the correct Security team for advice. There are very limited data insights as the data is mostly unstructured making it difficult to analyse and produce insights into where improvements can be made.
2.3 - Previous process
HMRC’s Security function currently receives queries and requests through multiple, inconsistent entry points, making it challenging to optimise demand management. This creates inefficiencies, makes it difficult to track work, limits visibility of risks and emerging threats, and places unnecessary pressure on Security teams. Without a single, consistent route for accessing Security services or a reliable dataset on Security demand, HMRC cannot effectively prioritise activity, identify opportunities for self‑service, or ensure Security teams are focused on the work that delivers the greatest value.
2.4 - Alternatives considered
The technology stack and infrastructure selected for Ask Security offered the best option available at that time. It aligns with HMRC CDIO architectural standards while offering an assistive tool for processing the information in the security policies.
Tier 2 - Deployment Context
3.1 - Integration into broader operational process
Generative AI Q&A / Chat, allowing internal users to access security policy advice and general guidance.
3.2 - Human review
Any HMRC colleague can use the tool by asking any IT Security Policy question. The colleague reviews the response and is invited to view the relevant policy or guidance documents as applicable. We also caveat each response to include the floowing, which is an example response not exact: ‘If you need detailed additional guidance you should consult your manager or the SIBP (Security and Information Business Partner) team.
3.3 - Frequency and scale of usage
This generative AI Q&A chatbot will only be used by internal HMRC colleagues (~65K colleagues). Ask Security query volumes per week since launch: Week 1 - 427, Week 2 - 1626, Week 3 - 1200, Week 4 - 417 and Week 5 - 494
3.4 - Required training
User comms and internal sharepoint pages which explain the use cases, limitations, and how to use Ask Security have been circulated across HMRC
3.5 - Appeals and review
N/A
Tier 2 - Tool Specification
4.1.1 - System architecture
Ask Security is a security policy chatbot. It is a core enabler of the new HMRC Security Operating Model, providing a centrally governed, auditable, consistent way for staff to access policy guidance.
The design reuses accredited platforms (Generative AI Landing Zone [GAILZ], Posit, SharePoint, Amazon WebServices Key Management Service), reducing architectural effort, allowing rapid prototyping, and ensuring compliance with HMRC cloud patterns.
Future‑proofed architecture modularises ingestion, retrieval and generation, enabling later convergence with Copilot Studio and deeper integration (e.g., ServiceNow workflow automation).
4.1.2 - System-level input
Where the user queries are input as text/string.
4.1.3 - System-level output
Textual reponses to a user query - Providing a centrally governed, auditable, consistent way for staff to access policy guidance.
4.1.4 - Maintenance
An Ask Security Data & Governance Board has been initiated to meet bi-monthly:
- Review the previous months Ask Security usage stats
- Number of visits, number of requests
- Responsiveness of the Ask Security product
- Qualitative performance review of the types of queries raised
- Query raised and response given align
- Response provided the correct policy guidance
- Response provided includes link to correct policy documents (if available)
- Impact of Ask Security on:
- Security and Information Business Partner (SIBP) teams requests received
These align by agreed categories
- HMRC Security Posture
- Policy teams – trend analysis of policy searches
- Considerations for any product enhancements for Ask Security
4.1.5 - Models
ChatGPT 4.1 using appropriate evaluation models with retrieval-augmented generation (RAG)
Tier 2 - Model Specification
4.2.1. - Model name
Azure Open AI GPT
4.2.2 - Model version
4.1
4.2.3 - Model task
The model is designed to answer user questions in natural language by retrieving relevant information from HMRC security policies and generating clear, human‑like responses
4.2.4 - Model input
The input to the model consists of:
- A user query (natural language question)
- Retrieved relevant content (policy document “chunks”)
- System prompts and instructions (to guide tone, accuracy, and constraints)
4.2.5 - Model output
A structured, natural language response based on retrieved policy content
4.2.6 - Model architecture
GPT-4.1 is an autoregressive large multimodal model (LMM) based on the Transformer architecture. It operates as a decoder-only neural network that processes text and vision inputs natively.
Methods and Optimisations Employed:
- Mixture of Experts (MoE): Utilises conditional computation to route tasks dynamically to specialised sub-networks, scaling capacity without a linear increase in compute costs.
- 1-Million Token Context Window: Optimised with advanced attention mechanisms to parse up to 1 million tokens of text or code simultaneously without requiring document chunking.
- Low-Latency Inference: Engineered for high-throughput processing to ensure immediate output generation without native “reasoning time” compute delays.
Explicitly Assigned Feature / Rule Weighting:
- Dynamic Latent Weights: The model does not use hardcoded rules or manual feature weights. Prioritisation is handled dynamically through weights optimised during training.
- RLHF Alignment: Reinforcement Learning from Human Feedback implicitly biases token probabilities to prioritise user intent, formatting instructions, and safety constraints.
- System Prompt Prioritisation: The internal attention mechanisms are trained to assign higher structural weight to system-level instructions to enforce strict schema and formatting compliance.
4.2.7 - Model performance
Formal statistical metrics (e.g. precision/recall) are less applicable to this use case. Instead, evaluation focused a human‑in‑the‑loop approach. Subject matter experts validated responses, identified gaps to improve the system and ensure outputs are accurate, safe, and policy-aligned. Now that As Security is live a feedback mechanism within the platform has been implemented so inaccuracies can be more easily reported and actioned
Privacy, Security, and Safety Controls:
- No training on HMRC data – all data is used only at inference time via RAG
- Azure OpenAI content filtering
- Prompt injection protection
4.2.8 - Datasets and their purposes
No direct training or fine-tuning of the model is conducted by HMRC. However, the primary data set for model refinement is comprised of HMRC Security Policy Documents:
- HMRC Security SharePoint sites
- HMRC Security Intranet content
Usage:
- Used as the knowledge base for Retrieval-Augmented Generation (RAG)
- Provides the authoritative content for model responses
2.4.3. Development Data
4.3.1 - Development data description
4.3.2 - Data modality
4.3.3 - Data quantities
4.3.4 - Sensitive attributes
4.3.5 - Data completeness and representativeness
Completeness: Dataset reflects available HMRC security policies and guidance Limitations: May not cover all edge cases or emerging policy areas
Representativeness:
- Represents HMRC Security domain only
- Not intended to represent external populations
4.3.6 - Data cleaning
4.3.7 - Data collection
4.3.8 - Data access and storage
4.3.9 - Data sharing agreements
Tier 2 - Operational Data Specification
4.4.1 - Data sources
Once deployed, Ask Security receives data from:
-User inputs (natural language questions submitted via the chat interface) - Retrieved HMRC policy content (via API calls to SharePoint using Microsoft Graph API)
4.4.2 - Sensitive attributes
Ask Security is designed not to process personal data or sensitive attributes:
- Users are explicitly instructed not to input personal or sensitive information
- The knowledge base only contains HMRC security policy documents (non-personal data) If a user ignores this warning and still submits this information, technical intervention GAILZ PII detection will be used to identify these instances and remove this information.
4.4.3 - Data processing methods
Pre-processing steps:
- User input is Vectorised (embedded) for semantic search
- Retrieved documents are chunked and indexed in advance
- Retrieved content is combined with user input via prompt construction
4.4.4 - Data access and storage
LLM interaction metadata/logs stored as traces in a local PostgreSQL application database. These traces are retained on a rolling basis for up to 30 days and then automatically deleted.
Access is restricted to authorised HMRC personnel via Role Based Access Control and Entra ID, following least‑privilege principles. Responsibility for storage and governance sits with HMRC Data Platform Services (DPS).
4.4.5 - Data sharing agreements
There are no data sharing agreements in place
Tier 2 - Risks, Mitigations and Impact Assessments
5.1 - Impact assessments
Business Impact Assessment issues and approved - document name 20260204-CSTS4344-Ask Alfred - BIA - approved 10th April 2026 CSTS4344-Ask Alfred- Security Risk and Accountabilities Document (SRAD) Approved and Issued to project and ESRR 17th February 2026 CSTS4344-Ask Alfred - Statement of Applicability - Approval 7th November 2025 (note that the “Ask Security” tool was previously given the working title “Ask Alfred” during development)
5.2 - Risks and mitigations
Risk: There is a risk that users may act on advice provided by Ask Security without independently validating sources or accuracy.
Mitigation:
- SMEs must regularly provide feedback on Ask Security outputs to ensure accuracy.
- Users must be made aware of the potential inaccuracies of AI and to cross reference all answers provided with HMRC Policy and Standards documents.
- Links are provided to the relevant policy for which the answer supports.
Risk: Uncontrolled user input
Mitigation:
- Rollout communications and adjacent AI-training reinforce that personal data should be entered with care into AI systems.
- Ask Security has a screen pop-up directing users not to add personal data.
- Ask Security has in-app notifications not to add PII or above OFFICIAL information.
- Ask Security’s LLM traces will be capped to 30 day rolling retention.
Risk: Susceptibility to prompt injection and model manipulation due to reliance on user supplied natural language input without absolute guarntees that malicious or crafted prompts cannot influence model behaviour.
Mitigation: The language model holds no session awareness, and is a processor not an initiator, so the blast radius is contained to GAILZ. GAILZ provides prompt shield and prompt injection checking as part of the service, and in case of suspicion, a 30 day rolling log contains all prompt traces. It would be possible to further mitigate with a constitutional-AI style coordinator, but this is considered overkill for the size/likelihood of the risk.