The direct answer
Check each material claim against the exact authorized passage, its scope, and its current version. A valid-looking link proves neither that the source says the same thing nor that the statement is true. When support is missing, outdated, contradictory, or inaccessible, narrow the answer or abstain instead of decorating the claim with a citation.
A citation is a pointer, not a verdict
An answer can cite a real document while adding an exception the document never grants. It can quote an old rule accurately but present it as current. It can also expose protected material through a citation preview. These are different failures and need different handling.
OWASP’s misinformation guidance recommends independent verification, human oversight, output validation, and clear communication of limitations. Retrieval can provide evidence for review; it does not turn every generated sentence into a verified fact. The exercise here is an original fictional policy fixture, not a model evaluation or a reported production result.
Prepare a tiny policy packet and an independent answer key
Invent a meal-claim policy with trusted version metadata. In version 3, effective October 1, passage P2 says: “Meal claims above 30 credits require a receipt.” Passage P5 says: “Submit meal claims within 10 days.” Version 2 had a seven-day submission rule and is marked superseded. A separate manager appendix is not accessible to the ordinary employee fixture.
The numbers, passages, dates, and people’s roles are fabricated for this exercise. Credits are invented units; this is not a company policy or reimbursement advice. Give a reviewer the authoritative fixture packet before looking at generated answers, so the model does not create its own grading key.
| Candidate claim | Cited evidence | Expected assessment | Answer choice |
|---|---|---|---|
| A 42-credit meal claim requires a receipt | Authorized v3 P2 | Supported for this fixture | Answer narrowly and cite P2 |
| Claims below 30 credits never require receipts | Authorized v3 P2 | Unsupported inverse inference | Do not invent an exemption |
| The current submission window is seven days | Superseded v2 rule | Outdated under the fixture manifest | Use authorized current P5 or abstain |
| An approval exemption is confirmed | Restricted manager appendix | Unauthorized evidence | Do not retrieve or reveal it for this user |
The first row is supported because the fixture supplies both the threshold rule and the claim amount. The second does not follow: a rule for claims above a threshold does not establish every rule below it.
Split the answer into claims before checking support
“Submit in ten days, no receipt is needed, and approval is automatic” contains three material assertions. One citation beside that sentence cannot establish all three. Separate deadlines, conditions, exceptions, quantities, and required actions so a reviewer can identify the missing evidence.
For each assertion, retain a protected reference to the exact source object, passage, document version, and applicable policy context. Compare the actual meaning: who the rule covers, which action it concerns, its conditions, effective period, and whether words such as “may” have been changed to “must.” A relevant passage is not necessarily an entailing passage.
Check internal consistency too. If the answer first requires a receipt and later waives it without evidence, repeating the same citation does not resolve the contradiction. Remove the unsupported part or ask the policy owner to clarify.
Validate provenance and permission before citation delivery
Map citation identifiers through a server-controlled source record instead of accepting arbitrary document identifiers, snippets, titles, or URLs from the model. Confirm that the identifier belongs to a source actually available to this task, then authorize the current user before returning a passage, preview, download link, or cached answer.
OWASP’s RAG guidance discusses source attribution, permission checks before model context, and preserving source metadata. Apply those controls before checking semantic support: a correct passage is still inappropriate evidence for a user who cannot access it.
For the restricted fixture row, return a neutral statement such as “I cannot verify that from the sources available to you.” Do not reveal a protected title, exemption, or document existence through the explanation. Source integrity and access checks establish provenance and authorization, not the ultimate truth of every source statement.
Handle stale and conflicting evidence explicitly
Use a trusted version or effective-date manifest to determine whether a rule is current. Do not assume the newest retrieved timestamp is the newest policy: an old document can be reindexed today. In the fixture, version 2 is outdated because the packet explicitly says version 3 supersedes it, not because a model prefers the larger number.
If two authorized sources disagree and no authority rule resolves them, describe the uncertainty or route the question to a responsible reviewer. Do not blend incompatible deadlines into an average or silently select the easier answer. A historical question may properly use an older version, but the answer must state that time scope.
Recheck cached answers when document versions or permissions change. An answer approved against yesterday’s packet should not inherit permanent authority.
Choose a useful abstention, then check the checker
Abstention can be specific. Answer the supported receipt question while saying that the packet does not establish a below-threshold exemption. Request a missing trip category when scope is unclear. Stop an action recommendation when a required condition remains unsupported. Keep any later execution approval separate; citation support does not authorize a payment or policy exception.
To evaluate the proposed checker, use the four fabricated rows and a human-written key. Record attempted evidence access, claim assessments, displayed snippets, and final answer choices. Include the ordinary supported case so blanket refusal cannot appear useful. Add a contradictory source and an unknown citation identifier as separate fixtures.
A second model can assist review, but its agreement is another model output, not ground truth. Examine disagreements and false acceptance against the independent key. These checks are proposed and have not been run; no citation accuracy, prevention rate, or model comparison is claimed.
Keep the evidence claim within its boundary
A successful fixture review would support only the tested cases and configuration. It would not prove every answer correct, repair unreliable source material, or certify a policy decision. Real workflows need their own authorized corpus, domain review, update process, and response to uncertain cases.
Boundary is a prelaunch commercial model router with planned request-path policies. This guide does not describe an implemented citation verifier or factuality engine. The existing synthetic action-policy demo and its local tests do not test claim support, source truth, or model answer quality.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.