Free executive playbook.

Your assistant answered the customer, cited the bank's own approved fee schedule, and linked the exact paragraph. The citation worked perfectly. The fee had not applied since last year. Nothing in that failure involves an attacker — a stale document and an unnamed owner are enough, and no faithfulness check catches it, because the answer is faithful to the wrong document. The citation has become the industry's proof of safety, and it proves exactly one thing: something real was quoted. Citation presence, claim support and current applicability are three different properties of an answer, and only the first is visible in the interface. Two Vietnamese duties already assume somebody is accountable for the answer a customer received — Law 134/2025/QH15 on Artificial Intelligence, in force 1 March 2026, with interaction-transparency, provider-reliability and incident duties and human oversight for high-risk systems; and the accurate-and-complete product-information duty in force since 1 July 2024 under Law 19/2023/QH15 Article 21, per the National Competition Commission's own published explanation. Neither sets a numerical accuracy threshold. The Grounded-Knowledge Architecture names six capabilities with intended use above all six and accountability wrapped around them, and assigns each of the five failures hiding behind the word "hallucination" a control and a first accountable owner. It is a proposed assignment, not a ratified standard — designed so a bounded pilot can falsify it.

What's inside

  • The reframe — citation presence vs. claim support vs. current applicability, with a table of what asserts each property, what actually proves it, and what a link proves on its own (the answer is: only the first, and no faithfulness check will catch the third) · plus the worked hypothetical in full: the fee answer whose citation was accurate down to the paragraph, approved by the right committee, by the right owner, on the right date — and wrong anyway, shown before and after the source correction, with current-answer retrieval excluding the expired schedule while a historical query can still reach it under an explicit date filter, and an escalation rather than a guess where the replacement is unapproved or its effective date ambiguous. HYPOTHETICAL throughout — no bank, no rate, no loss figure, no reported incident, and none is needed, because the ordinary version is the one that reaches a customer
  • Five failures, five owners — retrieval miss (retrieval engineering lead), unsupported generation (assistant product owner), correct-but-superseded (policy or product content owner), correct-but-out-of-scope (customer-outcome owner) and misread table or scan (document ingestion owner) — each with the observable symptom, the controls, and the first accountable owner, plus the quieter sixth: the unreconstructable answer, where the bank cannot recover the evidence it used once a customer disputes it months later, owned by the service owner and controlled by evidence retention and an incident process. It is the proposed diagnostic model rather than a measured distribution of causes, several failures can be true of one answer at once, and none of the five needs an attacker — adversarial corpus poisoning is the previous framework's subject, not this one
  • The six capabilities — proposed, not ratified — each with the single executive question that exposes whether it has an owner, the evidence of implementation to ask for, and its residual risk: G1 authoritative evidence (which approved version applies to this customer and this date — with tested withdrawal from current retrieval, against the residual risk of content correctly tagged but substantively wrong at source) · G2 retrieval and parsing (did the system find and correctly read the applicable passage — retrieval tests that deliberately include tables, scans and qualifying footnotes, against the residual risk that the right passage is retrieved then misinterpreted) · G3 claim attribution (can every material claim be traced to its evidence — claim-to-span links, source version and retrieval timestamp as a reconstructable answer record, against the residual risk that a valid link accompanies a false inference) · G4 scope and abstention (what happens when evidence is missing, conflicting or out of scope — tested clarification and refusal paths and a handoff verified to complete, with coverage reported alongside error because a system that refuses everything looks flawless on one and useless on the other) · G5 verification (does the evidence support a correct, currently applicable answer — three separate checks rather than one collapsed faithfulness score, a judge calibrated against expert raters rather than assumed, and expert adjudication on the material cases, against the residual risk that an automated judge shares the model's own errors, because consistency is not truth) · and G6 accountability (who approves, maintains and corrects the service — a named business release owner, named source owners, a stated freshness commitment for how fast a policy change reaches the index, and a working incident-and-correction route to the customer, against the residual risk that logs and named owners do not by themselves guarantee timely action)
  • Why the structure is shaped this way — why G3 and G5 stay separate, because traceability records the reference while verification judges whether it supports the claim, and collapsing a log into a judgement lets a valid-looking link stand in for a checked answer · why accountability is retained as a capability in its own right and built first rather than last, because neither good retrieval nor a complete audit trail assigns responsibility for calling the customer back · why there is no seventh layer, scope and presentation cutting across the whole architecture rather than bolting on as a stage · and why ordering matters more than numbering: define intended use and ownership, establish authoritative evidence and an initial test set, then iterate retrieval, attribution and abstention against those tests
  • Posture, the release test and the Vietnam layer — three deployment postures with implementation intensity scaled to consequence, a recommended policy rather than a legal classification and explicitly not permission for a customer-facing service to omit verification or ownership: the internal staff assistant, where staff verification implements much of G5; the customer informational assistant, where unsupported or conflicting claims route to a person or a pre-approved response rather than a generated guess; and the action-triggering assistant, where grounded prose alone never authorises an account change · the release test — one product or policy domain with a named owner, the evaluation set built before you tune anything as 5 gates it must close (missing source, stale version, conflicting documents, question out of scope, table read correctly), a held-out release set kept apart from the tuning questions, coverage recorded alongside error, and expansion only on criteria you chose against your own baseline, with content-maintenance and human-review effort tracked alongside inference cost · no accuracy target and no calendar duration are prescribed, because there is no verified public banking grounding rate to anchor one to · and the one-afternoon diagnostic: take the six executive questions into your next technology committee, write down who owns each answer, then ask which of the three properties your assistant actually measures

Five pages · free with a member sign-in · PDF.

One note on the downloadable edition, in the interest of the same traceability this playbook argues for. Its page-3 diagnostic table is headed "Five failures. Five different owners." and then lists six rows, the sixth being the unreconstructable answer, before referring to "the six failures above". The framing on this site is the deliberate one and matches the video: five failures produce a wrong answer, and a sixth is the failure to be able to reconstruct any of them afterwards, which is why this site treats it under G6 rather than as a peer row. Same control, same owner, one layout apart — no claim differs between the two editions.

Watch: youtu.be/HUARQj_VWVU — Video 15: Five Failures Hide Behind One Word Hallucination, 8 minutes 20 seconds.

Want the weekly version? Subscribe to The AI Architect Letter · Read the full analysis · Read the latest insights.