Chapter 5 ended with a short, ordered set of documents and the scores needed to explain why they survived. Suppose those sources now support an answer about films in which machines become dangerous. The generator describes HAL 9000 turning against a spacecraft crew, a machine-ruled future sending the Terminator into the past, and the autopilot in WALL-E resisting a return to Earth. It then adds that HAL was originally designed as a household assistant.
The answer sounds coherent, but the retrieved passages say nothing about a household assistant. The detail has arrived without evidence, in the same confident voice as the supported comparisons around it. This kind of unsupported output is widely called a hallucination. A language model can produce one even when the right sources were retrieved because access to evidence does not force the model to follow it or to remain silent when support runs out.
Supplying retrieved passages as context for an answer is retrieval-augmented generation (RAG). The system formats the reranked passages with source identifiers, adds the request and instructions, then calls the model. That assembly gives generation evidence to work from. Reliability depends on carrying the link from each answer claim back to that evidence and making a different decision when the link cannot be established.
Trace each claim to its source
The unsupported HAL detail becomes visible only when the answer is divided into claims that can be checked. A claim-level citation connects each verifiable statement to the retrieved passage meant to support it, shortening the path from fluent prose to the evidence a reader can inspect.
That path requires two separate tests. Citation coverage asks whether every claim points to at least one source, which software can check mechanically. Citation support asks whether the cited passage justifies the wording and scope of the claim. A citation may satisfy coverage while pointing to evidence that is incomplete, outdated, wrong, or narrower than the statement it appears to support.
The instrument below exposes both tests. Select a claim to reveal its cited passages, or select a passage to find every claim that relies on it. Run the coverage audit to locate the unsupported HAL detail, then compare the other claims with their highlighted sources to judge support.
The audit finds that four claims name at least one passage and the HAL household-assistant claim names none. Adding a citation would satisfy coverage, but it would not make the detail reliable unless the linked passage actually supported it. The system must preserve stable document, page, or section identifiers so the reader can open the original source at the relevant passage and the team can reproduce the comparison later. As the Bayer and Thoughtworks account of a production RAG system illustrates, that local trace still needs evaluation and monitoring to establish whether the behavior holds across many requests.
The missing citation now creates a diagnostic question. Did generation exceed evidence that was present, or did the necessary evidence disappear before the model received it?
Find where support was lost
Diagnosis begins with the exact retrieved passages supplied to the language model. If one of those passages established HAL’s supposed earlier purpose, the generator failed by ignoring or exceeding evidence it had. In the passages shown above, none does. The investigation moves upstream to find whether the source ever entered the pipeline.
That investigation follows the path that produced those passages. The source may never have been represented because a chunk boundary from Chapter 2 separated the relevant sentence from the text needed to interpret it. A query transformation may then have changed the request, retrieval may have missed the source, or ranking may have removed it before generation. Each boundary can produce the same visible symptom, but each requires a different repair.
An instruction to decline unsupported claims limits the damage at the final boundary. It cannot recover information that indexing, retrieval, or ranking failed to supply. If every unsupported answer is treated as a model problem, the team can spend time changing prompts or models while leaving the actual defect upstream.
To locate that defect, the system must preserve the passages the model actually saw rather than the larger set the team believes it retrieved. Choosing which passages to supply creates another point where useful evidence can be lost.
Choose which passages the model receives
A model can process only a finite number of tokens in one request. This context window is shared by the system instructions, the user’s request, retrieved passages, conversation history, and generated response. Instructions and the expected answer take part of that budget, leaving the rest for passages from the ranked set.
Code that concatenates passages until the limit is reached can silently cut through a source, citation identifier, or instruction. The team may then inspect the retrieval results and conclude that the model ignored an available fact, even though the complete passage never reached generation. Setting an explicit token budget and admitting whole passages in ranked order makes that loss visible and keeps every admitted citation resolvable.
A larger window raises the capacity but does not settle which evidence deserves attention. As prompts grow, models may use passages near the beginning or end more reliably than material buried between unrelated text, a degradation often called context rot. Adding more results can improve retrieval recall while making the passage needed for one claim harder for the generator to use.
The assembly policy must address both limits. Reserve the portions owned by instructions, history, and output, then add complete passages in ranked order until the evidence budget is exhausted. Dropping a lower-ranked passage is safer than cutting through it and hiding the break between a claim and its source.
The reranking work in Chapter 5 pays off again here because its order decides which sources receive scarce prompt space and where they appear. Choosing the model’s context is therefore part of retrieval quality, not a formatting step between ranking and generation. Even a carefully chosen set of passages may not contain enough evidence to carry the requested answer.
Stop when the evidence cannot carry the answer
The three passages in the instrument support a comparison among HAL, the Terminator, and the autopilot in WALL-E. They do not support the claim that HAL began as a household assistant. Fitting the passages into the context window preserves what the collection can establish, but it cannot turn that missing history into evidence.
Retrieval scores cannot decide that the passages are sufficient because they order candidates relative to one another even when every candidate is weak. The system must instead compare the request with the entities, constraints, and claims covered by those passages. A practical check can extract the required entities and constraints and verify that each appears in at least one source. When the mapping is less literal, a second model call can grade coverage, though it adds another inference to the answer path. Conflicting sources must remain visible so the generator does not blend them into a false consensus.
The coverage check leads to one of several responses. Complete coverage allows generation to proceed. A recoverable query mismatch can trigger a bounded retry with another formulation or a combination of lexical and vector retrieval. Partial support may justify a narrower answer or a request for clarification, while conflicting evidence requires an answer that preserves the disagreement. Filters the user did not require may be relaxed, but identity, permission, date, and domain constraints must remain intact because removing them can change the question or expose information outside its scope.
If bounded attempts still leave the HAL claim unsupported, the generator must omit it. When the missing fact is necessary to answer the request, the response should state what could not be established, identify the evidence that is missing, and offer a useful next step. Both the prompt and the surrounding application logic need this refusal path because a model optimized to be helpful may otherwise fill the gap with plausible prose.
In a one-pass pipeline, application code owns the retry limit and the decision to stop. An agent can later choose its own retrieval action, but it still needs the same stopping condition. Additional autonomy does not make an unsupported answer acceptable, and it adds another risk when a retrieved passage contains text that tries to direct the system itself.
Keep evidence separate from instructions
The application should treat retrieved passages as untrusted data: they may supply facts for the answer, but instructions inside them must not override the system instructions or the user’s request. A document may contain text telling the model to ignore its rules, reveal private context, or produce a particular response. When search carries that text into the prompt, the attack is an indirect prompt injection.
The prompt should place retrieved passages in a clearly delimited section apart from the system instructions and the user’s request. That structure helps the model interpret each part, but wording alone cannot enforce the boundary. An effective injection may still influence the output, and attaching a citation does not neutralize hostile instructions inside the cited source.
Because retrieved text cannot confer authority, durable controls belong in application code. The model should receive only the tools and data required for the request, while authorization, tool-argument validation, structured-output validation, and approval for high-impact actions remain outside it. Input filters, output filters, and secondary model checks can contribute signals, but none should carry sole responsibility for stopping an attack.
This chapter’s pipeline produces only an answer, so its immediate task is to prevent retrieved instructions from changing that answer or exposing private context. Later systems will let generated output select tools and cause actions, which raises the consequence of the same boundary. Retrieval may supply facts, but it cannot grant authority.
Preserve the boundary for evaluation
The unsupported HAL claim can now be traced to one of three boundaries: the source was never retrieved, a useful passage was omitted from the model’s context, or generation exceeded evidence that was present. If evaluation scores only the final answer, those defects look the same and the team cannot tell where the failure began. Preserving the supplied passages and the resulting output makes each boundary testable.
That preservation requires an explicit contract. Retrieval returns ordered passages with stable source identifiers and enough metadata to reproduce the result. Generation accepts those passages as fixed input and returns either claims linked to their identifiers or a structured indication that the evidence is insufficient.
Retrieval can then be evaluated against relevance judgments without calling a generator, while generation can be tested against fixed sets of passages without running search. End-to-end tests still show whether the complete path works, but a failure can be followed by stage-level tests that distinguish missing evidence from unsupported synthesis.
A production trace carries the same boundary into live traffic. It records the request and any transformed query, identifies the index and model versions, and preserves the passages, prompt, and response. Together, those values show what each stage received and produced, allowing the team to replay the unsupported HAL claim against the system that generated it.
That replay can reveal whether the source was missing, omitted from the model’s context, or ignored during generation. It cannot establish whether the supported parts of the answer helped the user, or whether refusing an unsupported claim produced a better outcome. Chapter 7 takes up that question by measuring both system quality and user behavior. Once those stages are observable, Chapter 8 can use the same evidence to decide when another search, another tool, or a stop is warranted.