Hallucination is a nuisance in a demo and a liability in a legal memo. The fix isn't a better prompt — it's making every claim trace to a real quote, and making an empty scope refuse instead of filling the gap with fluent prose.
Same assistant, two questions. The first is grounded in the master services agreement and cites the exact clause. The second has no Delaware authority ingested for this matter — so it refuses and names the empty scope instead of guessing.
The model writes the same confident sentence whether it found the answer or made it up. Nobody catches the difference until someone acts on it.
A reviewer asks which document supports a claim and the honest answer is that nobody knows — the citation, if there is one, doesn't point anywhere specific enough to check.
Trust in the system is asymmetric. Nine correct, cited answers build confidence slowly; one confident hallucination in a client-facing document ends the pilot.
An instruction is a request, not a constraint. The model can still generalise past what was retrieved, especially when the retrieved context is thin and the question is easy to guess at.
Temperature controls word-choice randomness, not whether the underlying claim is true. A deterministic wrong answer is exactly as wrong as a creative one.
A list of documents that were retrieved is not the same as a claim that traces to a specific quote. Nothing stops the model from citing a real document next to a claim it doesn't actually support.
Models are tuned to be helpful, not silent. Without an explicit empty-scope check, the default behaviour under uncertainty is a plausible-sounding guess, not a refusal.
Not a source list — a typed pointer per claim: the chunk, document, and exact quote it came from, pinned by content hash so it can't drift after the fact.
The same typed-label scope binding used for permissions also defines what counts as "in scope" for this answer — so the model can't reach past the evidence it was actually given.
Zero chunks in a required scope is not treated as "try anyway" — it's a refusal that names which scope was empty, recorded on the run like any other outcome.
Every cited claim shows the exact text it came from, so verifying an answer is a click, not a re-read of the source document.
A missing or empty scope narrows retrieval to nothing rather than quietly widening to the full corpus — the same rule that keeps permissions safe keeps answers honest.
"I can't answer, this scope is empty" is a valid run outcome with its own state, not an error path bolted on afterward.
The same missing evidence produces the same refusal every time, instead of an answer that varies by phrasing or model mood.
