Citations required, validator enforces

For any LLM-backed synthesis feature, the model must cite the source documents it claims to ground each statement in. And then a validator must reject any output that cites IDs not in the retrieved candidate set. The validator is the load-bearing piece. Without it, the model invents IDs that look plausible.

The two halves of the contract

The prompt requires citations. Strict JSON output, every claim carries an evidence_msg_id or evidence_thread_id. No citation, no claim. The model is allowed to say "I don't have enough evidence"; it is not allowed to make up evidence.

The validator enforces. After the model returns, you walk every claim's citation IDs and check them against the set of message/thread IDs you retrieved and put in the prompt. Any ID that didn't come from your retrieval is a hallucination. The validator rejects the entire response and the feature degrades to "no answer available."

Either half alone fails. Prompt-only "please cite" gets you fabricated IDs that look right. Validator-only without citation requirements has nothing to validate. The pair is what makes the feature trustworthy.

Why this is the bug-stopper

The class of bug it prevents: the model returns a plausible answer with a plausible citation, and the user reads the citation, trusts it, and acts on it. The cited message doesn't actually say what the model claimed. Without validation you'd never know — the ID is in the right shape, the message exists somewhere, the user has no easy way to spot the lie.

Validation makes the lie impossible at the protocol level. If the model cites an ID, the ID came from the retrieval. The model can still misinterpret what the message says, but it can't invent that a message exists.

Provenance is not support

Citation membership proves that a source was available to the model. It does not prove that the source supports the claim. That second question needs its own check: a bounded evidence evaluator, a deterministic rule where possible, or human review for high-risk decisions.

This gives the evidence contract two separate tests:

• Provenance: does the cited span exist in the allowed input set?
• Support: does that span actually justify the extracted fact or claim?

Keeping those tests separate avoids overstating what an ID validator can guarantee. See LLM as Evidence Interpreter.

Adjacent guardrails

The pattern works best when paired with:

• Filters enforced before the prompt, not by the LLM. Date ranges, sender filters, label filters — apply them to the retrieval, then ask the LLM only about what you handed it. Don't ask the LLM "answer the question, but only consider messages from last week"; it'll cite messages from two years ago and confidently date them as recent.
• Explicit "not enough evidence" path. The model must be able to refuse. Forcing an answer guarantees hallucination when the answer isn't in the corpus.
• Cache invalidated by content hash, not by time. When the retrieved set changes (new messages, edited content), the cached answer is stale because the citations might no longer hold.

Citation adjacency in decision pages

Human-facing briefs need the same contract in a form a reviewer can inspect quickly. Put the source link beside the factual sentence, score or definition it supports. A source appendix is useful for navigation, but it does not establish which source belongs to which claim.

Notto Competitor Watch also shows the limit of link validation. Its publisher rejects unsafe local links and leaked internal paths. It does not prove that every factual result has a link or that the linked page supports the sentence. Those are separate checks, just as provenance and support are separate in LLM synthesis.

Until that content contract is structured and validated, inline evidence remains an author-and-reviewer rule. See Evidence-backed monitoring systems.

Where this generalizes

Anywhere an LLM synthesizes over retrieved context:

• RAG question-answering over docs
• Code-review bots citing line ranges
• Compliance summarizers citing policy sections
• Chat agents citing knowledge base articles

The protocol is the same. Retrieval produces a candidate set. The prompt asks for cited answers. The validator gates on "citations must be in the candidate set." When the validator rejects, the feature has to have somewhere honest to go — usually "show the user the retrieval results with no synthesis."

What this rules out

• LLM output trusted on text alone, without checking what it cited
• Citation IDs in some opaque "the model knows" namespace, not the retrieval namespace
• "We'll add validation later" — synthesis features without validation ship hallucinations into the audit log
• Loose citation formats that can't be programmatically checked (free-text "see message X" instead of structured IDs)

See also

• Deterministic Before LLM — citations matter most when the LLM is doing synthesis; deterministic checks don't need them
• LLM as Evidence Interpreter — validates the narrower claim that a cited span supports one atomic fact
• Decision Trace Is the Explanation — carries validated facts through a replayable decision
• Governed Agent Architecture — separates evidence, policy, and action
• LLM-as-Judge Beats Substring Scoring — adjacent: trusting LLM output requires structural checks, not vibes
• Mxr — concrete validator lives in the safety LLM handler and is reused across ask/decisions/briefings/expert/whois