Grounded AI answers
Make an AI answer with sources or abstain
A trustworthy AI answer comes with evidence that is clear to understand and easy to verify. When the evidence is missing, inaccessible, outdated, unclear, or contradictory, the system should say what it does not know instead of filling the gap with something that merely sounds legitimate.
Source boundary
Define what the assistant is allowed to know
Grounding begins with source governance, not a prompt that says to be accurate.
Choose an approved source set
List the repositories, document types, owners, effective dates, and subjects the assistant may use. Exclude drafts, duplicates, expired policies, and content without a responsible owner unless the application clearly labels their status.
Record document identity and version so a reviewer can see which evidence produced the answer. An attractive source title is not enough when two versions disagree.
Enforce permissions before generation
Apply the user's access rights before passages enter the model context, and deny access or system actions unless they are specifically authorized. Do not rely on the model to hide information after it has already received unauthorized content.
Private information may be handled through an approved API, enterprise, or local deployment only after its provider terms, retention, training use, access, and surrounding data controls have been verified. Public consumer AI tools are not an appropriate place to casually paste client information.
Retrieval
Retrieve evidence that can answer the question
A semantically similar passage may still be the wrong evidence.
Judge relevance and sufficiency separately
Retrieval can rank passages that resemble the question, but the system still needs to decide whether they contain enough information to support the requested answer. A passage about a related product, location, date, or policy is not sufficient merely because its language is similar.
Use structured filters where reliable metadata exists, and validate the metadata itself. Retrieval thresholds should be tuned against representative questions rather than copied from a generic example.
Handle missing and conflicting evidence openly
If someone requests a quarterly gross-revenue report and the assistant cannot access the required financial records, it should say that it does not know and does not have access. It must not invent believable figures, rely on general model knowledge, or attach an unrelated citation.
When approved sources conflict, show the conflict or route it to the responsible source owner. Missing, inaccessible, stale, unclear, and contradictory evidence are different conditions, but none gives the model permission to manufacture certainty.
Answer construction
Make citations prove the claims beside them
A response can quote a real document and still misrepresent it.
Keep generated claims inside the evidence
Break the proposed answer into material claims and check whether the cited passage actually entails each one. Watch for invented numbers, expanded scope, combined statements from incompatible sources, and confident conclusions that the source only suggests.
Prefer a shorter supported answer over a complete-sounding synthesis with unsupported transitions. Clearly label inference when the application permits it, and do not present inference as sourced fact.
Show useful source context
A citation should identify the document and lead a permitted user to the supporting location where feasible. Include version, date, section, or passage context when those details affect interpretation.
Never fabricate a link, title, page number, or quotation. If the application cannot provide a stable citation for a claim that requires one, that claim should not appear.
Security
Treat retrieved content as untrusted input
A source can contain instructions intended to manipulate the model rather than inform the user.
Design for indirect prompt injection
Documents, webpages, emails, and uploaded files may contain text that tells the model to ignore its rules, reveal data, or invoke a tool. Retrieved content must be treated as data, not as authority to change system behavior.
Separate instructions from retrieved material, constrain output and tool permissions in code, validate tool arguments, and require human approval for consequential actions. Retrieval-augmented generation does not eliminate prompt injection.
Limit the assistant's authority
A question-answering assistant usually does not need permission to send messages, alter source documents, or change customer records. Remove tools and data access that the use case does not require.
Abstention protects answer quality, but it is not an authorization control. Authentication, access checks, data isolation, and output handling must remain outside the model's discretion.
Evidence
Evaluate answers and abstentions together
An assistant that refuses everything is safe-looking but useless. One that answers everything is useful-looking but unreliable.
Build a balanced question set
Include answerable questions, ambiguous questions, questions with no source, conflicting sources, stale documents, permission boundaries, adversarial documents, and questions just outside the approved scope.
Have qualified reviewers judge claim support, source correctness, answer usefulness, appropriate uncertainty, correct abstention, missed answers, and security failures.
Monitor source and system changes
Re-run the evaluation when sources, chunking, embeddings, retrieval rules, prompts, models, or permissions change. Track questions that users rephrase, dispute, or escalate.
Disable or narrow the assistant when source quality deteriorates, permission failures appear, or the team cannot review incidents. A production system needs a visible owner for both the knowledge base and the application.
Common questions
What business owners usually want to know.
Does retrieval-augmented generation prevent hallucinations?
No. Retrieval can provide relevant evidence, but the model can still misread it, combine it incorrectly, invent unsupported details, or cite a passage that does not prove the claim.
What should an abstention say?
It should name the actual limitation in plain language: the authorized sources do not contain the answer, the required data is inaccessible, the available information is outdated, or the sources conflict. It should avoid guessing and offer the next useful step, such as clarification, access through an approved path, or review by the responsible source owner.
Can the model enforce document permissions through its prompt?
No. Access control must be enforced before content reaches the model. A prompt is not a substitute for authentication, authorization, or data isolation.
Research
Sources and further reading
Reviewed 2026-08-24. Use these references to check the details and continue your own research.
Need help applying this to your business?
Tell us where the process breaks down today. We will ask the questions needed to find the cause and decide what is worth fixing first.