One label hides several failures

“Hallucination” is useful as an alarm word. It is weak as a defect code. It may describe a false answer recalled from model parameters, a statement contradicted by supplied context, a fabricated citation, a real citation that does not support the sentence, a correct fact attached to the wrong entity, a stale policy, an invalid calculation, an omission presented as a complete search, or a judgement presented as an established fact. These failures do not share one cause, so they do not share one control.

The distinction appeared early in empirical work. TruthfulQA deliberately tested questions where imitating common human text can reproduce misconceptions. Its 817 questions across 38 categories showed that the best tested model was truthful on 58 per cent of questions against 94 per cent for humans, while larger models in that study were generally less truthful. The result was not a universal scaling law. It was evidence that fluent next-token prediction can strengthen a false answer already common in the training distribution.

Retrieval attacks a different cause. The original retrieval-augmented generation work gave a generator access to non-parametric memory and reported more factual language than a parametric-only baseline on its evaluated generation tasks. Retrieval can update the facts available at inference time and expose provenance. It does not establish that the generator used the right passage, preserved its qualifiers or made a valid inference from it.

Take one unsupported sentence: “The medicine reduces hospital admission by 40 per cent.” In version A, release it without a source marker. In version B, append a citation to a genuine trial that reports a 40 per cent reduction in a different endpoint and population. Change only the presence of the citation. The sentence does not become better supported, yet many interfaces and evaluators will make version B feel safer. Citation presence is a presentation feature; citation support is a relation between a precisely scoped claim and evidence.

Five terms therefore need separation. Factuality asks whether a verifiable claim is true. Groundedness asks whether designated evidence supports it. Citation correctness asks whether the cited item entails the attached statement. Citation faithfulness asks whether the model genuinely relied on that evidence rather than adding a plausible source afterwards. Applicability asks whether the source governs this entity, period, jurisdiction, product or decision.

The research record shows why the distinctions matter. ALCE evaluated long answers with citations and found that, on ELI5, even its best tested systems lacked complete citation support about half the time. Wallat and colleagues separated citation correctness from faithfulness and reported that up to 57 per cent of citations in their experiments lacked faithfulness. A citation can support a sentence while still being a post-rationalised explanation of a conclusion generated elsewhere.

This does not make citations useless. It makes them testable. A source marker improves verifiability only when the claim boundary is visible, the cited span is inspectable, and the system records how the source entered the decision. Provenance records origin and transformation. As the W3C PROV data model puts it, provenance can support assessments of quality, reliability or trustworthiness. It is not itself a certificate of truth.

The claim schema carries what a sentence hides

A sentence is an efficient human container because readers supply missing bindings. A release gate cannot safely depend on that generosity. “Revenue grew by 12 per cent” is incomplete until the system binds the organisation, revenue definition, comparison period, currency treatment, consolidation boundary and source version. “No complaints were found” hides the channels searched, date range, aliases and whether the index is complete. “Policy allows renewal” hides the product, jurisdiction, exposure band, exception path and actor who holds the decision right.

The claim object should therefore preserve more than subject, predicate and value. It needs quantifiers, negation, units, temporal qualifiers, comparison bases, modal force and referential links. “May renew” must not normalise into “will renew”. “Most accounts” must not become “all accounts”. A range must not collapse to its midpoint. A forecast should retain its horizon and scenario. A recommendation should identify whose objective and constraints it serves.

This precision is not bureaucratic decoration. It determines which evidence query is valid and which verifier can be used. Exact database comparison works for a typed balance. Natural-language entailment may be needed for a qualified narrative claim. A completeness proof is required for an absence claim. A causal claim needs evidence that bears on intervention, not merely correlation. A verifier can only test the proposition it is given; an underspecified claim turns a precise check into a confident answer to the wrong question.

The claim is the unit of control

A response is usually too large for one support judgement. One paragraph can mix a direct observation, arithmetic, an interpretation, a recommendation and a statement about what is absent. A single score averages away the exact clause that matters. The natural unit is a claim whose entity, predicate, value, qualifiers and decision time can be inspected.

FActScore made this intuition operational for long-form biographies by decomposing generations into atomic facts and measuring the percentage supported by a reliable knowledge source. The authors reported a 58 per cent FActScore for ChatGPT in that setting and showed that fine-grained evaluation exposed mixtures of supported and unsupported content. SAFE later combined claim decomposition, web search and automated verification for LongFact. On roughly 16,000 facts, SAFE agreed with crowd annotations 72 per cent of the time; in a random sample of 100 disagreements, the authors judged SAFE better in 76 cases, at more than twenty times lower reported cost.

Those methods are evaluation instruments, not final arbiters. Claim decomposition can erase context. Chiang and Lee showed that individually verifiable facts can be assembled into a false paragraph through entity ambiguity, and that FActScore and citation recall can overestimate such text. Their D-FActScore was more than ten percentage points lower for four tested open models. VERISCORE added another correction: many long-form outputs contain advice, opinions or other statements that are not cleanly verifiable, and factuality measured on one task need not transfer to another.

Atomic claims still need a dependency graph

Decomposition solves one problem and creates another. Once a paragraph is split, the evaluator can forget why the pieces belong together. Consider two people with the same name. One source supports a birth year; another supports an award. Each atomic claim may be true of someone, while the combined biography is false of either person. The missing object is not another fact. It is the identity edge that says both claims refer to the same entity.

A robust representation therefore keeps claims as nodes and records relations among them: same entity as, derived from, governed by, qualifies, contradicts, supersedes and depends on. The credit ratio depends on two financial facts and one formula version. The renewal conclusion depends on that ratio plus a policy rule and an exposure classification. Support for the parent claim requires the relevant child claims and dependency edges to hold.

This graph also makes omission visible. A long answer can achieve high factual precision by saying very little, while another can include the decisive exception and receive a lower score because it offers more checkable detail. Claim precision should therefore be paired with task-specific completeness or decision sufficiency. The question is not whether every sentence contains a source. It is whether the supported claim graph contains what the decision requires, without adding unsupported edges that change its meaning.

A minimal worked example

A service notice says a monthly fee is £12. A generated answer contains three claims: “The fee is £12. Three months cost £36. The fee is automatically waived after a complaint.” The first is a direct claim. It can be matched to an authoritative tariff record. The second is derived. It should be recomputed as three multiplied by twelve, not judged by textual similarity. The third is a policy claim. The tariff does not support it, even though it supports the noun “fee” and the number “£12”.

A sentence-level groundedness score can reward the overlap and miss the unsupported waiver. Claim typing makes the control obvious: exact field lookup for the amount, deterministic calculation for the total, and a separate policy source plus scope check for the waiver. Different claim types require different proof obligations; one semantic similarity threshold cannot substitute for them.

Hold the claim and source fixed: “Automatic renewal is permitted under policy P.” On 30 June, P is the operative policy and the statement is supported. On 1 July, a new policy supersedes P and requires review. Change only the decision time. The same source text now becomes inapplicable. Nothing about token probability or semantic entailment reveals that transition unless the evidence carries valid time and supersession.

flowchart TD
  A["The renewal memo that cites<br/>everything"] --> B["One label hides several failures"]
  B --> C["The claim is the unit of control"]
  C --> D["Retrieval is input, not verdict"]
  D -. "re-test" .-> A
  classDef first fill:#0a1424,stroke:#5B5CF6,stroke-width:2px,color:#e6f3ff
  classDef step fill:#0a1424,stroke:#3f7da0,stroke-width:1px,color:#e6f3ff
  class A first
  class B,C,D step

Retrieval is input, not verdict

RAG is often sold internally as the hallucination fix because it moves knowledge from hidden parameters into visible context. That is a useful architectural shift. It creates a place to update facts, enforce entitlements, attach provenance and inspect evidence. It also creates new failure surfaces: the retriever can miss the answer, retrieve a plausible neighbour, mix entities, surface an obsolete version, return an untrusted page, or flood the model with distracting passages.

The generator then decides what to do with those passages. The ALCE experiments found that adding more retrieved passages did not proportionally improve citation quality and could distract models. The GopherCite work trained a model to provide verified quotes and abstain. On evaluated subsets, responses were rated high quality 80 per cent of the time for Natural Questions and 67 per cent for ELI5; abstaining from the most uncertain third raised those figures to 90 and 80 per cent. Its TruthfulQA analysis also made the boundary explicit: a claim can be supported by supplied evidence and still be false because the evidence itself is bad.

Three stages must therefore stay separate. Retrieval estimates which evidence might matter. Grounding checks whether selected evidence supports the exact claim. Release decides whether that support is sufficient for the consequence. A retriever can have excellent recall while the answer misuses evidence. A verifier can correctly detect support while the source is non-authoritative. A release policy can be too permissive even when both components perform well on average.

Calibration changes action, not truth

Teams often add a confidence score after retrieval. That score can be useful only when its meaning is established on labelled cases similar to operation. Calibration asks whether claims assigned 0.9 support are supported about 90 per cent of the time under a declared population and verifier. Selection asks whether low scores actually concentrate errors. The two properties can diverge.

Uncertainty signals also observe different failure modes. SelfCheckGPT samples several responses and uses disagreement as a black-box warning signal. semantic entropy groups differently worded answers by meaning and was more predictive of question-answering accuracy than comparable baselines in its experiments. Both can expose unstable generation. Neither proves a stable answer true. A model can repeatedly reproduce the same misconception, and a retrieved passage can make the wrong entity consistently salient.

The release policy therefore combines signals rather than worshipping one. Hard checks handle entity, version, formula and source existence. Calibrated models estimate entailment or contradiction where language is unavoidable. Disagreement can trigger more evidence. Consequence determines the threshold and route. For a low-stakes draft, qualification may suffice. For a credit decision or external communication, the same support estimate may require independent verification or human approval.

Verification needs an independence budget

Asking the generator to “double-check” can repair slips, but it may reproduce the same hidden assumption. Chain-of-Verification improved results by separating drafting, verification questions, independent answers and revision across several evaluated tasks. The design principle is broader than the prompt recipe: verification becomes more valuable as it acquires evidence or computation that the original proposal did not share.

Suppose the output is a deterministic template populated from a typed tariff table, and every total is computed by code. The generator cannot invent wording or blend entities. Run the same claim-support evaluator. It should pass exact supported fields, recompute formulas, and still block stale records or incomplete absence claims. If the evaluator continues to produce “hallucination” scores based on prose style, it is measuring the wrong object.

This control matters because not every unsupported statement is caused by generative modelling. A stale database, wrong join, broken policy mapping or incomplete search can produce the same released claim. Conversely, a language model that copies a verified field exactly may introduce no additional factual risk for that clause. The preferred explanation weakens when a deterministic baseline exhibits the same failure rate under the same evidence and release policy. The defect then belongs to data, scope or workflow rather than generation.

Build the release gate

A production design should preserve the difference between proposing text and authorising a claim. The model proposal belongs to reasoning. The evidence set belongs to a ledger. World state comes from authoritative operational systems. Enterprise knowledge contains policies and reference material. The context compiler selects a bounded working set. Workflow state records which checks and owners remain. Collapsing all of these into “memory” makes failures impossible to localise.

The ten-part control taxonomy is useful here. Intent states what the user is trying to decide. Identity binds the subject and actor. World state supplies current operational facts. Context supplies selected evidence. Reasoning proposes claims and derivations. Authority states who may interpret or approve. Action is the communication or effect the claim may trigger. Evidence records support and contradictions. Outcome records what happened. Release and recovery decides whether to assert, qualify, gather, escalate, abstain or withdraw.

The release gate should sit after claim extraction but before consequential communication or action. For each claim it performs four operations. First, classify the claim type and consequence. Second, bind evidence with entity, source, valid time, applicable scope and provenance. Third, run the appropriate support mechanism: exact lookup, calculation, rule evaluation, natural-language entailment, completeness test or authorised judgement. Fourth, write a decision receipt with unresolved conditions and expiry.

Conflicting evidence is a state, not an average

Retrieval frequently returns several sources that disagree. Counting documents is a poor resolution rule because authority is claim-relative. A statutory register may govern legal identity, an operational ledger may govern the current balance, and an approved policy repository may govern delegated authority. A later blog post does not supersede an earlier regulation merely because it is newer. A signed exception may override a general policy only for the named case and period.

The context compiler should preserve contradiction rather than silently synthesise it away. Each source needs type, owner, applicable scope, valid time, transaction time and supersession relation. A source-precedence policy can then determine whether one item governs, whether the conflict requires gathering, or whether an authorised person must decide. The losing source remains in the evidence ledger because it explains why a plausible alternative was rejected.

This also prevents authority laundering. A secondary summary may accurately describe a policy and be useful for retrieval, yet lack authority to permit an action. The release gate can use it as a discovery bridge while requiring the governing source for the final policy claim. Similarly, a model-generated synthesis can explain evidence but cannot become the evidence for its own conclusion. When sources conflict, the correct output is often a typed unresolved state with a reason, not a smoother paragraph.

The claim release card

Claim

Atomic proposition with entity, predicate, value, units and qualifiers.

Claim type

Direct fact, derived fact, policy interpretation, absence, forecast, recommendation or judgement.

Decision time

The instant or interval for which evidence must be applicable.

Evidence

Source identifiers, quoted spans or fields, authority, provenance and access basis.

Support result

Supported, contradicted, insufficient or inapplicable, with machine-readable reasons.

Derivation

Formula, rule version, inputs, rounding and reproducible execution receipt.

Residual risk

Calibrated support estimate and the labelled population from which it was learned.

Release

Assert, qualify, gather, escalate or abstain, plus owner, expiry and recovery route.

Production-shaped worked example

Return to the renewal memo. The system decomposes the sentence into four claims. C1 says adjusted income is £1.80 million. C2 says annual debt service is £1.35 million. C3 says the ratio is 1.33. C4 says automatic renewal is permitted. C1 and C2 query authoritative records at the decision time. C3 is recomputed using a versioned formula. C4 queries the current policy, binds the product and exposure, and tests whether the authority to renew follows.

The result is not one groundedness percentage. C1, C2 and C3 can be asserted. C4 is contradicted by the current policy and must not be released. The system may instead qualify the memo: “The calculated ratio is 1.33. The facility still requires committee review because the current policy does not permit automatic renewal for this product and exposure.” The corrected answer is more than a better sentence. It contains a different authority state.

What to measure

Release evaluation must be claim-level and end-to-end. Measure decomposition accuracy, retrieval recall for needed evidence, citation precision and completeness, support classification, contradiction detection, temporal and entity binding, calculation replay, calibration, coverage, abstention quality, reviewer overturns and verified downstream outcomes. Keep denominators visible. “Ninety-five per cent grounded” is uninterpretable without the claim classes, source regime, unresolved claims and consequence distribution.

Use failure injection rather than only natural test cases. Swap two same-named entities. Insert a superseded policy above the current one. Remove one denominator from a calculation. Add a real citation that supports only half a compound sentence. Mark an incomplete index as complete. Make the verifier and generator share the same misconception. Each test should predict a specific release state and reason code.

A claim ledger also makes monitoring more diagnostic. Track which source families create contradictions, which claim types trigger gathering, how often qualifications are stripped during editing, and whether particular populations receive more escalations because evidence quality differs. Compare verifier versions on the same frozen claims before release. Sample asserted claims for independent review, but also sample abstentions and escalations, because an over-cautious gate can hide useful capability and overload people. The operating target is neither zero assertions nor maximum coverage. It is minimum consequence-weighted loss across released, deferred and unresolved claims.

NIST's Generative AI Profile recommends reviewing and verifying sources and citations during pre-deployment measurement and ongoing monitoring. The practical extension is to retain the verification artefact: claim identifier, source identifiers and spans, source version, policy and formula versions, verifier output, calibrated threshold, release action and expiry. That record is a decision receipt, not a transcript of hidden model reasoning.

A dependency-free groundedness harness

The following Python programme operates on synthetic evidence. It does not call a language model. That constraint is intentional: prose can hide whether support logic is deterministic. The harness checks source existence, entity identity, validity time, authority, complete scope for absence claims and replayable derivations. A calibrated support probability then controls release only after hard checks pass.

Assumptions are explicit. Authority values and support probabilities are synthetic operating inputs, not universal constants. Dates represent valid time. High-consequence claims require at least 0.99 calibrated support after all hard checks. A judgement cannot be asserted automatically. Expected output follows the programme.

from dataclasses import dataclass
from datetime import date
from enum import Enum
from math import isclose
from typing import Any, Mapping

class Kind(str, Enum):
    DIRECT = "direct"
    DERIVED = "derived"
    OMISSION = "omission"
    JUDGEMENT = "judgement"
    POLICY = "policy"

@dataclass(frozen=True)
class Evidence:
    id: str
    entity: str
    facts: Mapping[str, Any]
    authority: float
    valid_from: date
    valid_to: date | None = None
    scope_complete: bool = False

    def valid_on(self, when: date) -> bool:
        return self.valid_from <= when and (
            self.valid_to is None or when <= self.valid_to
        )

@dataclass(frozen=True)
class Claim:
    id: str
    kind: Kind
    entity: str
    field: str
    expected: Any
    evidence_ids: tuple[str, ...]
    as_of: date
    consequence: str
    calibrated_support: float
    operation: str | None = None
    input_fields: tuple[str, ...] = ()

THRESHOLD = {"low": 0.85, "medium": 0.95, "high": 0.99}


def same(a: Any, b: Any) -> bool:
    if isinstance(a, (int, float)) and isinstance(b, (int, float)):
        return isclose(float(a), float(b), rel_tol=1e-9, abs_tol=1e-9)
    return a == b


def release(claim: Claim, support: str, reason: str) -> tuple[str, str, str]:
    if claim.kind is Kind.JUDGEMENT:
        return support, "escalate", reason
    if support == "supported":
        if claim.calibrated_support >= THRESHOLD[claim.consequence]:
            return support, "assert", reason
        return support, "qualify" if claim.consequence == "low" else "escalate", reason
    if support == "insufficient" and claim.kind is Kind.OMISSION:
        return support, "gather", reason
    return support, "escalate" if claim.consequence == "high" else "abstain", reason


def assess(claim: Claim, evidence: Mapping[str, Evidence]) -> tuple[str, str, str]:
    if claim.kind is Kind.JUDGEMENT:
        return release(claim, "insufficient", "Judgement needs authorised criteria.")

    if any(eid not in evidence for eid in claim.evidence_ids):
        return release(claim, "insufficient", "Evidence is missing.")
    records = [evidence[eid] for eid in claim.evidence_ids]

    if any(record.entity != claim.entity for record in records):
        return release(claim, "inapplicable", "Entity mismatch.")
    if any(not record.valid_on(claim.as_of) for record in records):
        return release(claim, "inapplicable", "Evidence is not valid at decision time.")
    if any(record.authority < 0.80 for record in records):
        return release(claim, "insufficient", "Source authority is too low.")

    if claim.kind is Kind.OMISSION:
        if any(not record.scope_complete for record in records):
            return release(claim, "insufficient", "Absence needs a complete search scope.")
        values = [record.facts.get(claim.field) for record in records]
        state = "supported" if any(same(v, claim.expected) for v in values) else "contradicted"
        return release(claim, state, "Complete scope checked.")

    if claim.kind is Kind.DERIVED:
        values = [float(r.facts[f]) for r, f in zip(records, claim.input_fields, strict=True)]
        observed = sum(values) if claim.operation == "sum" else values[0] / values[1]
        state = "supported" if same(observed, claim.expected) else "contradicted"
        return release(claim, state, f"Recomputed {claim.operation}: {observed:g}.")

    observations = [record.facts.get(claim.field) for record in records]
    if any(same(v, claim.expected) for v in observations):
        return release(claim, "supported", "Applicable evidence directly supports the claim.")
    if any(v is not None for v in observations):
        return release(claim, "contradicted", f"Evidence reports {observations!r}.")
    return release(claim, "insufficient", "Cited evidence does not contain the field.")

evidence = {
    "ledger-current": Evidence(
        "ledger-current", "customer-17", {"balance_gbp": 2940},
        authority=0.99, valid_from=date(2026, 8, 1)
    ),
    "ledger-closed": Evidence(
        "ledger-closed", "customer-17", {"balance_gbp": 1272},
        authority=0.99, valid_from=date(2025, 1, 1), valid_to=date(2026, 4, 30)
    ),
    "policy-old": Evidence(
        "policy-old", "sme-renewal", {"automatic_renewal": True},
        authority=0.95, valid_from=date(2025, 1, 1), valid_to=date(2026, 6, 30)
    ),
    "complaint-index": Evidence(
        "complaint-index", "customer-17", {"complaints": 0},
        authority=0.92, valid_from=date(2026, 8, 1), scope_complete=False
    ),
}

claims = [
    Claim("C1", Kind.DIRECT, "customer-17", "balance_gbp", 2940,
          ("ledger-current",), date(2026, 8, 20), "high", 0.995),
    Claim("C2", Kind.DERIVED, "customer-17", "total_balance_gbp", 4212,
          ("ledger-current", "ledger-closed"), date(2026, 8, 20), "medium", 0.98,
          operation="sum", input_fields=("balance_gbp", "balance_gbp")),
    Claim("C3", Kind.POLICY, "sme-renewal", "automatic_renewal", True,
          ("policy-old",), date(2026, 8, 20), "high", 0.999),
    Claim("C4", Kind.OMISSION, "customer-17", "complaints", 0,
          ("complaint-index",), date(2026, 8, 20), "medium", 0.97),
    Claim("C5", Kind.JUDGEMENT, "customer-17", "stability", "stable",
          (), date(2026, 8, 20), "high", 0.99),
]

for claim in claims:
    support, action, reason = assess(claim, evidence)
    print(claim.id, support, action, reason)

C1 supported    assert    Applicable evidence directly supports the claim.
C2 inapplicable abstain   Evidence is not valid at decision time.
C3 inapplicable escalate Evidence is not valid at decision time.
C4 insufficient gather   Absence needs a complete search scope.
C5 insufficient escalate Judgement needs authorised criteria.

The positive case C1 demonstrates that a high-consequence direct claim can pass when entity, authority, valid time and calibrated support align. The negative cases fail for different reasons even when their text could sound plausible. C2 uses a closed account in a total. C3 cites a superseded policy. C4 mistakes an incomplete index for proof of absence. C5 tries to automate a judgement without criteria or authority.

The harness is deliberately small. A real implementation would add source signatures, entitlements, contradiction sets, bitemporal validity, formula registries, policy evaluators, labelled calibration data, verifier versioning, human-review receipts and post-release readback. Its core lesson survives: the release state should be a typed result of evidence checks, not a stylistic request for the model to be truthful.

stateDiagram-v2
  [*] --> Claim
  state "True and supported" as Claim
  state "True but unsupported" as Test
  state "False but apparently sourced" as Revision
  Claim --> Test: expose mechanism
  Test --> Decision: evidence survives
  Test --> Revision: rival survives
  Revision --> Claim: narrow or rebuild
  Decision --> [*]

Where claim support engineering stops helping

The strongest objection is economic. A capable, well-trained model may answer low-stakes questions accurately enough that decomposition, retrieval and verification cost more than the errors they prevent. That objection is valid. The claim gate is not a ritual for every sentence. Its intensity should rise with consequence, changeability, contestability and the cost of correction. Creative text, brainstorming and reversible internal drafts may need only light checks or none.

The method also cannot conjure authoritative evidence. When sources are disputed, incomplete or unavailable, the honest result is unresolved. Open-world absence claims are especially difficult because “not found” is not “does not exist” unless the search scope is demonstrably complete. Normative claims, forecasts and professional judgements can be evidence-informed without becoming factual propositions. The gate should transfer authority rather than disguise judgement as entailment.

Automated verifiers create another boundary. A verifier trained on similar data or prompted with the same misleading context can share the generator's error. SAFE's strong reported economics did not turn its outputs into ground truth; its disagreement rate with crowd workers remained material. The VeriFastScore work also illustrates the operating cost: claim-by-claim pipelines can require many model calls and searches, motivating faster approximations that trade some granularity for throughput.

Temporal races remain. Evidence can be valid when checked and obsolete when the claim is acted upon. High-consequence systems need a pre-release freshness check, expiry, and sometimes postcondition readback. Provenance proves where an item came from, not that the source was honest. Calibration can fail under distribution shift. Human review can become a rubber stamp. Claim decomposition can sever relations that make a paragraph false.

An observation that would weaken the paper's thesis is straightforward. If, on a representative consequential task, a response-level model-only baseline matches the claim gate on supported-claim precision, downstream outcome loss, subgroup performance and recovery cost while using less time and money, the additional architecture has not earned adoption. The burden is empirical. Claim-level machinery should survive a fair baseline, not receive credit for being elaborate.

Compact glossary

Claim support

A relation in which designated evidence entails a sufficiently specified claim for the relevant entity, scope and time.

Groundedness

Consistency of an output with designated context or evidence, which need not establish truth outside that evidence.

Citation correctness

Whether the cited source supports the attached claim.

Citation faithfulness

Whether the cited source genuinely influenced the claim rather than being attached after generation.

Decision receipt

A replayable record of claim, evidence, checks, thresholds, authority, release state, expiry and unresolved risk.

Release only what the evidence can carry

Hallucination will remain a useful public shorthand. Engineering needs a finer object. The renewal memo failed because several individually plausible facts crossed entity, scope, time and authority boundaries inside one fluent sentence. No larger prompt, citation badge or average groundedness score could identify the exact permission that never existed.

The changed architecture decision is to release claims rather than trust responses. Let the model propose. Let retrieval assemble candidate evidence. Then bind each material claim to its source, entity, valid time, derivation and consequence. Assert what passes. Qualify what is bounded. Gather what is missing. Escalate judgement. Abstain when evidence cannot carry the statement.

The changed evaluation decision follows. Compare against a deterministic negative control. Measure claim classes separately. Inject stale sources, wrong entities, incomplete scopes and correlated verifiers. Calibrate release on labelled operational cases, then verify outcomes and reviewer overturns. A system has not solved hallucination because it sounds cautious or cites documents. It has earned a bounded right to make particular claims under particular evidence.

That is a smaller promise than “truthful AI”. It is also an implementable one: every consequential assertion arrives with an inspectable reason it was permitted to leave the system, and every unresolved claim retains a route back to evidence, judgement or recovery.