A product answers questions over governed data, and people act on what it says. Ask a raw model for a figure the corpus does not contain and it will supply one anyway: plausible, well formatted and wrong. Nobody reading it has a reason to doubt it, which is what makes it worse than silence. On governed or regulated data, provenance and the ability to abstain are requirements. And because answers lead to actions, the flow has to survive a crash and stop at a human checkpoint before anything happens.
A retrieval system writes from what it fetched, and only a separate check can say whether it did.
Retrieval-augmented generation works in two halves. First, a search. The documents in the corpus are split into passages, and each passage is converted into a list of numbers, called an embedding, that places it on a kind of map where passages with similar meaning sit close together. A question is converted the same way, and the passages nearest to it are fetched. Second, a draft. Those passages are handed to a language model together with the question, and the model writes an answer.
The weakness sits in the gap between the halves. The model is asked to use the passages, but nothing forces it to. It has absorbed an enormous amount of general pattern during training, and when the passages are thin, off topic or silent on the exact figure requested, it fills the gap from that pattern. The result reads exactly like a grounded answer. Fabrication in these systems is rarely a malfunction. It is the model doing what it was built to do, which is to produce the most plausible continuation of the text in front of it.
Closing the gap means adding a step the model does not control. The answer is broken into individual claims, and each claim is checked against the passage it cites: does this passage actually say this. Claims that fail are blocked. When nothing in the corpus supports an answer, the honest output is to say there is insufficient data. Two further pieces make this hold over time. Fencing the search to the governed corpus means every cited passage comes from a permitted source. And replaying a stored set of past questions after every change shows whether a new prompt or model has quietly broken something that used to work.
Everyone's first instinct was a better or bigger model. That instinct puts trust in the one place it cannot live. A model cannot vouch for its own output. Trust comes from the system around it: what is retrieved, what is checked against evidence before it is shown, and what happens when the evidence is not there. The model is a component. The surrounding system is the product.
Retrieval systems fail quietly, and their worst answers read the best.
The common failure is invisible at the point of use. A system answers a question the corpus cannot support, the answer is well phrased, it may even carry a citation, and the person reading it has nothing to compare it with. The failure surfaces later, when a figure has driven a decision and someone eventually traces it back to a document that never contained it.
The second pattern is decay. A retrieval system that works on launch day is tuned to the prompts, the model and the corpus of launch day. Each of those changes. A prompt is adjusted to fix one complaint, a model version is upgraded, new documents arrive. Without a way to replay earlier questions after each change, quality drifts and nobody can say when it started.
The reflex, and the fix.
Chase a bigger model
It is the lever everyone reaches for, and every new release makes it look more reasonable.
A larger model fabricates more fluently. Scale does not turn an ungrounded claim into a checkable one, and on governed data the fluency is the hazard.
Put the model behind a gate and an abstain path
A faithfulness judge, an explicit abstain path, prompt versioning, a regression harness, and a graph runtime with a human checkpoint.
Trust as a property of the system, which holds whichever model happens to sit inside it.
Make trust structural, because a model cannot be argued into being trustworthy.
Retrieval fenced to the governed corpus
Vector search is scoped to the data an answer is allowed to come from. That fence is what makes provenance possible at all, because every passage the model sees has a known, permitted source.
The model drafts and nothing more
It writes the draft. It does not decide whether the draft is true, and it is never the last step in the chain.
A faithfulness judge in front of the user
Each generated claim is scored against the evidence it cites before anything is shown. Low-scoring output is blocked. A plain pipeline ships exactly this output, because nothing in it ever compares the answer with the source.
Insufficient data as a real answer
When grounding is missing the system says so. Abstaining is a correct output with its own place in the interface, and it is never dressed up as an error.
Prompt versions and a regression harness
Every model or prompt change re-runs a library of earlier traces. Drift shows up in the harness before release, so a customer is never the one who finds it.
A graph runtime that resumes after a crash
The flow keeps its state through interruption and halts at a human checkpoint before any action is taken, so a restart neither loses a step nor repeats one.
What each choice cost, and what it bought.
ADemoting the model to one component
The tempting design makes the model the authority and spends effort making it better. Treating it as one component among several adds moving parts and some latency, because every draft passes through checks before it reaches anyone. What it buys is independence from any particular model. When a model is upgraded or replaced, the gate, the abstain path and the harness stay where they are, and they judge the new model by the same standard as the old one. A bigger model on its own would have been more fluent and no more checkable.
BGiving abstention a place in the product
Saying there is insufficient data looks like a failure in a demo, and some questions now go unanswered. Building it in as a designed outcome, with its own wording and its own place in the interface, means every answer that is shown is one the system can stand behind. It also turns a vague worry about accuracy into a concrete product question: which questions does the corpus actually support, and what should be added so it supports more.
CBuilding the harness before touching cost
Prompt versioning and a regression harness are work with no visible feature at the end. The payoff came later. Once every change re-ran past traces, cost work stopped being a gamble, because a change that saved tokens and lost accuracy showed up immediately. That is how a 38% token-cost reduction and a 45% accuracy lift arrived together. Without the harness, the cheaper configuration would have shipped on hope.
DA runtime that resumes, with a person before any action
Answers here lead to actions, so the flow runs on a graph runtime that keeps its state through a crash and pauses at a human checkpoint. Persisting state costs engineering time and the checkpoint slows the path to action. It buys a system that never leaves a step half done, never repeats one on restart, and never acts on an answer nobody has looked at.
A single headline number hides where a system fails. This work was scored on the dimensions that actually decide whether it holds in production, measured on real, held-out cases rather than the demo path.
38% token-cost reduction and 45% accuracy lift are measured. The zero-fabrication claim stays qualitative pending a provenance artifact.
A fluent system that answers everything, cites nothing anyone can check, and invents a plausible figure on exactly the questions where a wrong answer is most expensive.
A retrieval system where every claim is checked against evidence, insufficient data is a valid answer, every prompt change passes a regression evaluation first, and the flow resumes after a crash with a human checkpoint before any action. Once the harness existed, cost work became safe, because any change that saved tokens and lost accuracy showed up at once. The result was a 38% token-cost reduction alongside a 45% accuracy lift.
What it owns, and what it hands to a person.
The cost and accuracy figures are measured. The claim that the system does not fabricate is stated qualitatively, on purpose, and will stay that way until a provenance artifact is attached to support it. A judge can only measure what it has evidence for. The corpus bounds what can be answered at all. And the regression set has to be maintained as the data and the questions change, or it slowly stops testing anything that matters.
Reliability at the top of an AI stack is mostly not a question of model quality. A system with no gate, no abstain path and no regression suite has no way of noticing that it has stopped being right. The fix is ordinary production discipline, applied to a layer where it is often missing.
A language model cannot certify its own output, so trust in a retrieval system has to come from checks that sit outside the model.
Fabrication is what a model does by default when the retrieved evidence is thin, which means the fix is a gate on grounding and the option to abstain.
Insufficient data is a valid answer, and designing it into the product turns a vague accuracy worry into a clear question about corpus coverage.
A regression harness that replays past questions is what makes later cost and prompt work safe, because it shows accuracy moving in the same run.
Any flow that acts on generated answers needs to survive a crash without losing or repeating a step, and needs a person in front of the action.