Citation presence, claim support and current applicability are three different properties of an answer. A grounded assistant can score well on the first and still fail your customer on the other two — and almost nothing in a standard demo tells you which one just happened.
This article lays out The Grounded-Knowledge Architecture — six capabilities, one of them wrapped around the other five, proposed as a way of assigning controls and owners to the five failures that hide behind the word "hallucination". It is offered as a testable design, not a finding, and a bounded pilot should be able to falsify part of it.
Why this matters now
A customer asks your assistant a simple question: what fee applies to this transfer today. The assistant answers, cites the bank's own approved fee schedule, and links to the exact paragraph. The citation works perfectly. The fee has not applied since last year.
That example is hypothetical — no bank, no rate, no loss, and it stays that way for the rest of this article. It is useful precisely because nothing exotic caused it. The retrieval worked. The document had been approved by the right committee, by the right owner, on the right date. The citation was accurate down to the paragraph. And the answer was wrong, because the paragraph stopped applying before the customer asked it.
This matters now for two reasons, one commercial and one regulatory. Commercially, the citation has become the industry's proof of safety. Grounded, retrieval-backed, evidence-linked — every assistant your teams are shown puts a small numbered reference beside the sentence and offers that reference as the assurance. Regulatorily, Vietnam's Law on Artificial Intelligence (134/2025/QH15), passed 10 December 2025 and effective 1 March 2026, places new duties on the provider side of that assistant: Article 11(1) requires disclosure that a person is interacting with a system, Article 12(1) assigns reliability and incident-response responsibilities, and Articles 14(1)(d) and 14(2)(b) require human oversight and the ability to intervene for high-risk systems. There is an eighteen-month transition in Article 35(1)(a), but read what it actually covers: it runs from effectiveness and applies to finance systems already operating before that date. A new deployment does not inherit it — the resulting 1 September 2027 date is a planning condition, not a blanket exemption.
Sitting alongside that is a duty already in force. Since 1 July 2024, under the Law on Protection of Consumers' Rights (19/2023/QH15) Article 21, the National Competition Commission's own published explanation of that article says a business owes customers accurate and complete information about its products and services. Neither instrument sets a numerical accuracy threshold. Both assume that somebody is accountable for the answer a customer received.
The problem: three properties, not one
Ask a technology team why a grounded assistant gave a wrong answer and you will usually hear one word: hallucination. Treat that as a single failure, fund a single fix, and you have addressed one property of the answer while leaving the other two unmanaged.
Here is the reframe this article argues for. Citation presence, claim support and current applicability are three different properties of an answer. A visible link establishes only the first. It says nothing about whether the cited passage actually entails the sentence next to it, and nothing about whether that passage is still the one that governs today.
| Property | What it asserts | What proves it | What a link proves |
|---|---|---|---|
| Citation presence | A reference was attached to the sentence | The link resolves to a real passage in a real source | Yes — this is all it proves |
| Claim support | The retrieved passage actually entails the assertion | Claim-to-span mapping, then a check that the span supports the claim | No |
| Current applicability | That passage governs this customer, product and date | Version, approval and effective-interval metadata, tested against the question's date | No — and no faithfulness check will catch it |
When a citation looks solid, leaders should still test whether it is current, because visual assurance and evidentiary assurance are not the same thing. Most banks deploy grounded assistants and stop checking once the citation renders, because the citation is the only one of the three properties visible in the interface.
A faithfulness check cannot catch a stale source — because the answer is faithful to the wrong document.
The fee example above is what the third property failing looks like when the first two hold. Show the same question before and after the source is corrected. In the corrected version, a query for the current answer excludes the expired schedule from retrieval entirely; a historical question — "what did the fee used to be" — can still reach the old schedule under an explicit date filter, because superseded material should stay available, not disappear. If the replacement schedule has not been approved yet, or its effective date is ambiguous, the assistant should escalate rather than guess.
Five failures, five different owners
The word "hallucination" hides at least five distinct failures, and they do not share a control or a budget line.
| Failure | What actually happened | First accountable owner |
|---|---|---|
| Retrieval miss | The applicable passage was never placed in front of the model; the answer is confident and the evidence is absent | Retrieval engineering lead |
| Unsupported generation | The passage was retrieved, but the material assertion in the answer is not entailed by it | Assistant product owner |
| Correct but stale | The answer is faithful to an approved document that no longer applies on the date the customer asked | Policy or product content owner |
| Correct but out of scope | A right answer to a different question — another product, jurisdiction, segment or authorized use | Customer-outcome owner |
| Misread table or scan | The right document, but the wrong row, unit, column, or a qualifying footnote that never made it into the text | Document ingestion owner |
Several of these can be true of a single answer at once, so do not infer the cause from the final answer alone. When a technology committee sees one wrong answer, leaders should still ask which of the five it was before assigning a fix, because a faithfulness check tuned for the second failure will not catch the third — the answer is faithful, just to the wrong document.
And notice what is absent from this list: no attacker, no jailbreak, no poisoned document. A stale schedule and an unowned control are sufficient. This week deliberately stays out of that adjacent territory — prompt injection, data poisoning and adversarial corpus attacks are the agent attack-surface map's subject, not this one.
There is a sixth failure, quieter than the five above and easy to miss because it has no symptom at the moment it happens: an answer the bank cannot reconstruct months later when a customer disputes it, because the evidence used at the time was never retained. It belongs to the service owner, its control is evidence retention plus a working incident process, and it is treated below under G6 rather than as a sixth row here — the five above are the five that produce a wrong answer, and this one is the failure to be able to explain any of them afterwards. The downloadable playbook lists it as a sixth row in the same diagnostic table; same control, same owner, one layout apart.
The Grounded-Knowledge Architecture: six capabilities, one accountability wrapper
What follows is the author's proposed way of assigning controls and owners to the five failures above — not a proven-necessary-and-sufficient standard, not a statutory stack, and not six products to buy. It is offered as a testable architecture that a bounded pilot should be able to falsify. One question sits above all six capabilities, and one capability wraps around the other five.
Intended use, first
Before any of the six, someone answers a narrower question: what is this service actually for, for which product, for which audience, and on what evidence base. Skipping this step is the most common reason a governance model bolted on afterward never fits the deployment it was written for.
G1 — Authoritative evidence
Executive question: which approved version applies to this customer and this date? Evidence of implementation: a named owner per source family, approval and validity metadata, and a tested removal of a superseded document from current-answer retrieval while keeping it reachable under an explicit historical query. The residual risk is content that is correctly tagged but substantively wrong at the source — a governance model, not an engineering one, catches that. This is the layer that would have caught the fee example, had the withdrawal actually been tested end to end through every index and cache the assistant reads from.
G2 — Retrieval and parsing
Executive question: did the system find the applicable passage, and read it correctly? Evidence of implementation: local retrieval tests that specifically include tables, scanned documents and qualifying footnotes, because those are exactly where a technically correct retrieval still hands the model the wrong number. The residual risk is that the right passage can be retrieved and still misinterpreted — G2 tests presence, not comprehension.
G3 — Claim attribution
Executive question: can every material claim in the answer be traced back to its evidence? Evidence of implementation: a claim-to-span link, the source version, and a retrieval timestamp, kept together as an audit-ready, reconstructable answer record. This is where "citation presence" actually lives, and it is deliberately kept separate from G5, because a valid link can still accompany a false inference.
G4 — Scope and abstention
Executive question: what happens when the evidence is missing, conflicting or simply outside the service's scope? Evidence of implementation: tested clarification and refusal paths, and a human handoff that is verified to complete, not just to fire. Report the coverage rate alongside the error rate here — a system that refuses everything looks flawless on error and useless on coverage, and only reporting both numbers together exposes that trade. The residual risk runs in both directions: an unnecessary refusal, or a handoff that fires and never lands.
G5 — Verification
Executive question: does the evidence support a correct, currently applicable answer? This is the capability that separates a checked answer from a cited one, and it is three checks rather than one — that the span supports the claim, that the source still applies on the relevant date, and that the answer is correct on its own terms. Evidence of implementation: those three checks run separately rather than collapsed into a single "faithfulness" score; a judge whose agreement with expert raters has actually been calibrated rather than assumed; and expert adjudication on the material cases, with the disagreements kept rather than averaged away.
The residual risk is the one most easily overlooked when a dashboard turns green: an automated judge frequently shares the model's own errors, so a high consistency score can mean the checker and the answerer are wrong together. Consistency is not truth. Report what the judge was calibrated against, and on which sample, or the number means nothing outside the team that produced it.
G6 — Accountability
Executive question: who approves, maintains and corrects this service? Evidence of implementation: a named business release owner, named source owners, a stated freshness commitment for how fast a policy change reaches the index, and a working incident-and-correction route to the customer. G6 is not the last thing you build; it is the first, because neither good retrieval nor a complete audit trail assigns responsibility for calling the customer back. It is also where the sixth, quieter failure lives — the unreconstructable answer, whose controls are evidence retention and an incident process. The residual risk is that logs and named owners do not by themselves guarantee timely action.
Two design choices are worth stating rather than assuming. Why G3 and G5 stay separate: traceability records the reference; verification assesses whether the reference actually supports the claim. One is a log, the other is a judgement, and collapsing them lets a valid-looking link stand in for a checked answer. Why there is no seventh layer: scope and interface clarity cut across G1 through G5 rather than adding a new box — they show up in the diagnostic, not as an extra gate.
Ordering matters more than numbering. Define intended use and ownership first, establish authoritative evidence and an initial test set, then iterate retrieval, attribution and abstention against those tests.
Two ways to build it
Before choosing capabilities, choose the shape of the service. The evidence base does not force a single architecture, and the smallest workable one is often the right one. An approved-answer or search service — a deterministic lookup against a curated, versioned set of documents, with little or no free-form generation — can satisfy a genuinely narrow use case (a rate lookup, a policy FAQ) with a fraction of the governance load below, because there is far less for G3 through G5 to check. A bounded generative assistant earns its complexity when the question set is broad enough, or varied enough in phrasing, that a fixed answer set cannot keep up — and it needs the full six-capability treatment to be worth that trade.
The framework's own contrarian conclusion, stated plainly: it may overcomplicate a service that only needed a small approved FAQ or a deterministic rate lookup. Long-context models may simplify retrieval for a genuinely bounded source set, but they still need the applicability and output checks above — a bigger context window changes G2, not G5. Corpus remediation, in many deployments, may deliver more value than any amount of generation tuning; that observation does not establish a universal share of errors attributable to G1, only that it is worth checking your own.
Matching the control set to the posture
The evidence does not support scaling any of the six capabilities to zero for a customer-facing service; it supports scaling the intensity of implementation to consequence. Read the table as a recommended policy, not as a legal classification, and not as permission for a customer-facing service to omit verification or ownership.
| Posture | Minimum practical implementation | Delivery boundary |
|---|---|---|
| Internal staff assistant | Owned current sources, tested retrieval, visible evidence links, explicit scope and escalation rules, an expert-reviewed release set with ongoing QA, a named incident owner | Staff verify consequential information before it reaches a customer; human checking implements much of G5 |
| Customer informational assistant | The same set, plus checks appropriate to material product or fee claims completed before delivery, tested refusal paths, and a handoff that is verified to work | Unsupported or conflicting claims route to a person or a pre-approved response, not a generated guess |
| Action-triggering assistant | The same set, plus authenticated authoritative transaction data, deterministic business rules, authorization checks, confirmation steps where warranted, and recoverability controls | Grounded prose alone never authorizes an account change; execution security is the adjacent surface covered in the agent attack-surface map, not here |
An internal assistant can lean on staff judgment for a meaningful share of G5. A customer-facing assistant cannot lean on the customer the same way — by the time the customer notices the answer was wrong, the consequence has usually already landed.
What the measured evidence does and does not say
The only quantified failure evidence this article admits comes from one study, and it deserves to travel with its full context every time it is cited. Researchers led by Magesh, with Surani, Dahl, Suzgun, Manning and Ho, published Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools as a preprint in May 2024, with the journal version accepted 14 March 2025 (DOI 10.1111/jels.12413). The study ran 202 preregistered questions against each of four systems. Lexis+ AI and Ask Practical Law AI each returned hallucinated responses to 34 of 202 questions; Westlaw AI-Assisted Research to 66 of 202; and GPT-4, tested without the legal-specific retrieval layer, to 87 of 202. Lexis, Practical Law and GPT-4 were tested between 22 March and 22 April 2024; Westlaw was tested 23–27 May 2024, on a version of the product that has since changed.
Treat that as a 2024 legal-research benchmark and a historical counterexample to "retrieval eliminates the problem" — never as a banking rate, never as today's rate, and never as a trend, since none of these products has been retested on the same terms since. What it establishes cleanly is narrower and more durable than any headline number: retrieval-backed commercial products, independently tested under realistic conditions, produced measurable hallucination in that period. That is enough to reject a universal claim of elimination. It is not enough to estimate your own bank's rate, which depends on your corpus, your questions and your own controls.
On the deployment side, the picture is qualified rather than absent. One bank has reported strong performance from a staff-assistant pilot that began in October 2023, without publishing its sample size, task rubric, language breakdown or an independent audit — a self-reported result, not an audited one, and this article omits its numeric headline for that reason. A separate institution reports that ninety-eight percent of its financial-advisor teams have adopted its internal generative assistant, alongside a described practice of expert evaluation and human review of outputs; that ninety-eight percent is an adoption figure, not an accuracy result, and the two should never be read as interchangeable. Read together, the honest statement is not "no bank has published an accuracy figure" — one plainly has — but that neither disclosure yet amounts to an independently audited, reproducible grounding rate a third party could check.
A short verification sidebar. In Mata v. Avianca, Inc. (S.D.N.Y., No. 22-cv-1461, 22 June 2023), Judge P. Kevin Castel sanctioned two attorneys and their firm USD 5,000, jointly and severally, plus corrective letters, for filing briefs containing fabricated case citations. The penalty was not per lawyer, and it was not a penalty for using an AI tool — it was for submitting fabricated authorities to a court without checking them first. As a professional-verification precedent it says something narrower than the industry retelling usually implies, and that narrower reading is the useful one: the failure a court punished was the absence of a check, not the presence of a tool.
The release test — 5 steps before you expand
None of the above is a reason to wait for a perfect corpus, and none of it licenses an indefinite pilot either. The evidence supports a bounded, falsifiable first step.
- Pick one product or policy domain with a named owner and an approved document set. Not an enterprise-wide remediation program — one tractable domain first.
- Choose the shape before you tune anything. Decide between an approved-answer or search service and a bounded generative assistant, using the trade in the section above, not a vendor's default.
- Build the evaluation set before you build the assistant. Cover five case types deliberately: a missing source, a stale version, conflicting documents, a question outside scope, and a table that must be read correctly.
- Separate the tuning set from the held-out release set, and add a monitored production sample once you are live, so the number you report is not the number you trained against.
- Expand only when the service passes acceptance criteria you chose locally — for material correctness, applicable evidence, useful coverage and successful escalation — and keep tracking recurring content-maintenance work and human review time alongside inference cost, because those are where the ongoing budget actually goes.
No accuracy target, no calendar duration and no enterprise-wide data-cleanup prerequisite belongs in step one. The evidence base does not support prescribing any of the three, and a bank that waits for a universal threshold before starting is optimizing for a number nobody has published.
Risks and caveats
This framework is a design recommendation, not a finding. The six capabilities are registered here as the author's proposed assignment of controls and owners; they have not been shown to be either necessary or sufficient for every bank, and the strongest counter-evidence — the legal-research benchmark above — measured commercial products in a different domain, on a different question set, in 2024. A bounded pilot that falsifies part of this architecture would be useful, not embarrassing, and the fastest way to find out is to run the release test above against a real domain rather than debate the architecture on paper.
Two more limits deserve to be named directly. First, the failure to locate a qualifying, independently audited public banking grounding rate is a scoped search result, not proof that none exists — and the claim that no bank has published an accuracy figure is false as a general statement, since at least one has. Second, this article stays inside its own boundary on purpose: it does not restate the model-risk assurance questions covered in the GenAI assurance grid, the adverse-action explanation duties covered in the adverse-action explainability ladder, or the enterprise data-foundation work covered in the data-readiness map. Those are related, load-bearing topics; they are not this one.
Before your next technology committee
Most banks deploy a grounded assistant, watch the citation render correctly in the demo, and treat that as the safety case closed. The citation is real. The fact that it is real is exactly why it is persuasive, and exactly why it says nothing about whether the cited material still applies.
Six capabilities, one wrapper: authoritative evidence, tested retrieval, claim attribution, scope and abstention, verification, and — around all of them — a named accountable owner. Take the six executive questions into your next technology committee and write down who owns each answer. Then ask the question this framework exists for: of citation presence, claim support and current applicability, which one does your assistant actually measure? When documents conflict, leaders should already know who takes the handoff.
Before trusting the answer, establish which source applies.
Every week, we send one architecture-grade framework like this one to leaders governing AI in banking, in The AI Architect Letter — one issue a week, no hype.
Sources & note. Primary and independent research only; all accessed 2026-09-06 unless stated. The quantified benchmark: Magesh, Surani, Dahl, Suzgun, Manning and Ho, "Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools", Journal of Empirical Legal Studies, journal version 2025, DOI 10.1111/jels.12413 — read from the article PDF rather than from commentary. The four counts quoted above are Table C1 of Appendix C, which reports hallucination counts on a total of N = 202 per system: GPT-4 87, Lexis 34, Practical Law 34, Westlaw 66. The paper's own abstract states the same result as a range — the tools made by LexisNexis and Thomson Reuters "each hallucinate between 17% and 33% of the time" — and Table B1 gives the proportions as 0.43 (GPT-4), 0.17 (Lexis), 0.17 (Practical Law) and 0.33 (Westlaw). Both the counts and the rates are therefore the study's own published figures, not a derivation; where this article gives counts it is because the study publishes counts. Section 5.3 is the source for the test windows: the dataset was preregistered on 22 March 2024, Lexis+ AI, Ask Practical Law AI and GPT-4 were queried between 22 March and 22 April 2024, and Westlaw AI-Assisted Research between 23 and 27 May 2024 — which is why this article says the Westlaw figure describes a version of the product that has since changed. The study's own stated limitation is carried here rather than omitted: "the sample size of 202 queries remains small". No banking rate is derived from any of this, and the counts are never presented as a trend, because no product has been retested on the same terms. Professional-verification precedent: Mata v. Avianca, Inc., S.D.N.Y. No. 22-cv-1461, sanctions opinion and order, docket document 54, 22 June 2023 (Castel, J.) — USD 5,000 jointly and severally against two attorneys and their firm, plus corrective letters. Stated above as jointly and severally rather than per lawyer, and as a sanction for filing fabricated authorities without checking them rather than for using an AI tool, because the industry retelling routinely gets both wrong. Bank disclosures, both carried as self-reports rather than audits: the DBS CSO Assistant announcement of 18 July 2024, describing a pilot from October 2023 — its numeric headline is deliberately not reproduced here, because the disclosure publishes no sample size, task rubric, language breakdown or independent review, and a figure without those is not a grounding rate; and the Morgan Stanley Debrief launch release of 26 June 2024, whose ninety-eight percent is an adoption figure across financial-advisor teams, not an accuracy result. An earlier framing of this topic in this series said that no bank had published an accuracy figure; that general claim is withdrawn — at least one has. The accurate statement is the narrower one made above: neither disclosure amounts to an independently audited, reproducible grounding rate a third party could check, and the failure to locate such a rate is a scoped search result rather than proof that none exists. Vietnam: Law 134/2025/QH15 (Artificial Intelligence), signed text of 10 December 2025, in force 1 March 2026 — Article 11(1) (disclosure of interaction with an AI system), Article 12(1) (provider reliability and incident-response responsibilities), Articles 14(1)(d) and 14(2)(b) (human oversight and the ability to intervene for high-risk systems), and Article 35(1)(a) (the eighteen-month transition). The transition is described above as running from effectiveness and covering finance systems already operating before that date, making the resulting approximate 1 September 2027 date a planning condition for pre-existing systems rather than a sector-wide exemption a new deployment inherits; the Prime Minister has not yet published the definitive high-risk list that will fix the exact scope of conformity assessment for banking, so no risk-tier count is asserted. Law 134/2025 is a separate instrument from Law 71/2025/QH15 (Digital Technology Industry). Law 19/2023/QH15 (Protection of Consumers' Rights) Article 21, in force 1 July 2024, with the accurate-and-complete product-and-service information duty taken from the National Competition Commission's own published explanation of that article rather than from the bare statutory text. Neither Vietnamese instrument sets a numerical accuracy threshold, and no bank-chatbot enforcement precedent exists yet under either — stated as a limit on the argument rather than left for a reader to assume. EU Regulation 2024/1689 (AI Act) of 13 June 2024, Articles 14, 15 and 50, is cited for comparative context only and binds no bank in Vietnam. All regulatory readings above are this series' reading of publicly disclosed primary text rather than a regulator's published interpretation. The worked fee example is hypothetical throughout — no bank, no rate, no loss, no reported incident — and no customer or employee data of any kind appears in this article. Independent thought leadership, not affiliated with any current or past employer, and not a substitute for your own legal, compliance, model-risk and data-protection review.