One Big Idea

The citation was accurate down to the paragraph. The fee it linked to stopped applying last year. No attacker was involved — a stale document and an unnamed owner were enough, and a faithfulness check will never catch it, because the answer is faithful to the wrong document.

Last week this letter asked where an AI agent actually gets attacked inside a bank. This week the question sits one layer earlier, before any agent acts on anything: does the answer your assistant just handed a customer actually apply today, or only to a document that used to be true? A footnote cannot tell you which. This issue is about the difference, and about who owns it when the footnote is right and the answer is wrong anyway.

The Insight · Three properties, one of them visible

A faithfulness check cannot catch a stale source, because the answer is faithful to the wrong document. That sentence is this week's whole argument, so read it twice.

Grounded, retrieval-backed, evidence-linked — every assistant your teams get shown puts a small numbered reference beside the sentence and offers that reference as the assurance. It proves one thing: something real was quoted. It says nothing about whether that material still applies on the date the customer asked, and nothing about whether the sentence actually follows from it. Citation presence, claim support and current applicability are three separate properties of an answer. When a vendor demo puts a clickable link beside every claim, leaders should ask which of the three the link actually proves.

The industry default is treating the citation as the whole proof. That is an improvement over an assistant that invents its sources outright, but it answers only the narrowest question: was something real quoted.

A 2024 benchmark by researchers led by Magesh at Stanford is worth sitting with here, because it is the only quantified failure evidence this issue admits, and it is a historical counterexample rather than a banking rate. They tested three commercial, retrieval-backed legal-research tools across 202 preregistered questions each, between March and May of that year. Hallucinated responses still came back 34 times out of 202 for two of the tools, and 66 times out of 202 for the third. A general-purpose model tested without retrieval, for comparison, hallucinated 87 times out of 202 — evidence that retrieval helps, sitting beside evidence that retrieval alone does not close the gap.

Those are 2024 legal-task counts on products that have since changed. Carry the study, the sample and the dates with any number from this benchmark, or leave the number out. It is never a substitute for your bank's own rate, because no independently audited banking grounding figure exists to compare it to — which is not the same as saying no bank has published anything. One has reported strong pilot performance without publishing a sample, rubric or independent review; another describes adoption and expert review. A self-report is not an audit, and adoption is not accuracy.

Framework of the Week · The Grounded-Knowledge Architecture

This is the author's proposed way to assign controls and owners to the problem — not a validated standard, not six products to buy, and not proof that six layers are necessary or sufficient for every bank. One question — what is this service for — sits above all of it, and accountability wraps around all of it. Inside that frame:

  • G1 · authoritative evidence — who owns which approved version, and does it leave current retrieval when it expires
  • G2 · retrieval and parsing — was the applicable passage even found, tables and scans intact
  • G3 · claim attribution — can every material sentence be traced to a span, in an audit-ready record rather than a courtesy link
  • G4 · scope and abstention — does the system ask, refuse, or hand off when evidence is missing or conflicting, with coverage reported alongside error
  • G5 · verification — does the evidence support a correct, currently applicable answer: three checks, not one, and beware a judge that shares the model's errors, because consistency is not truth
  • G6 · accountability — the wrapper, named as a capability in its own right, because a named release owner, source owners, a freshness commitment and a person who owns the correction to the customer are things you either have or do not

Two of those separations carry the design. G3 and G5 stay apart because traceability records the reference while verification judges whether it supports the claim — one is a log, the other is a judgement. And G6 is built first rather than last, because neither good retrieval nor a complete audit trail assigns responsibility for calling the customer back.

Use Case · The fee answer, and it is hypothetical on purpose

HYPOTHETICAL — not a reported bank incident. A customer asks the assistant what fee applies to a transfer today. The assistant answers, cites the bank's own approved fee schedule, and links the exact paragraph. The citation is accurate. The retrieval worked. The document was approved by the right committee. And the fee stopped applying last year, because a newer schedule replaced it and nobody excluded the old one from current-answer retrieval.

No faithfulness check catches this, because the answer is faithful to the wrong document. The fix is not a smarter model; it is a named owner who withdraws superseded versions from current retrieval while keeping them reachable under an explicit historical query, and an assistant that escalates instead of guessing when the replacement is ambiguous.

Risk Note · Five failures, five owners — and the Vietnam layer, stated accurately

Resist the one-word diagnosis. Technology teams will call this "hallucination" and reach for one fix; that word hides five distinct failures with five distinct owners, and none of them needs an attacker. A retrieval miss belongs to the retrieval engineering lead. Unsupported generation — the passage was there but the claim does not follow from it — belongs to the assistant's product owner. Correct-but-stale, our fee example, belongs to the policy or product content owner. Correct-but-out-of-scope belongs to whoever owns the customer outcome. A misread table — wrong row or unit in a scanned schedule — belongs to whoever owns document ingestion. Most banks fail this test not because a model lied, but because a stale schedule and an unnamed owner were enough on their own.

And get the Vietnamese law right rather than dramatic. AI Law 134/2025/QH15 took effect on 1 March 2026: interaction transparency, provider reliability and incident responsibilities, and human oversight for high-risk systems. Its eighteen-month transition applies only to finance systems already operating before that date — there is no blanket September 2027 cliff for a new deployment, and saying otherwise misstates a real law to make a weaker argument sound stronger. A separate consumer duty, in force since 1 July 2024 under Law 19/2023/QH15 Article 21, requires accurate and complete product information, per the National Competition Commission's own published explanation — a relevant basis, not a numeric accuracy guarantee, and no bank-chatbot enforcement precedent exists yet under either instrument.

For what "nobody checked" costs a professional rather than a customer: in June 2023, in Mata v. Avianca, a federal judge sanctioned two lawyers and their firm USD 5,000, jointly, for filing fabricated authorities — not for using AI, for not verifying it.

Before trusting the answer, establish which source applies.

One line for your next architecture review, and do not let a clickable link end the conversation: of citation presence, claim support and current applicability, which one does your assistant actually measure?

Latest Video

This week's briefing — Video 15: Five Failures Hide Behind One Word Hallucination — walks the architecture end to end on screen in 8 minutes 20 seconds, including the hypothetical fee example shown before and after the source correction.

Watch: youtu.be/HUARQj_VWVU

The full deep-dive — the three-property reframe, all five failures with their owners, the six capabilities with their residual risks, the two ways to build it, the posture table, and the sources and caveats in full — is in The Grounded-Knowledge Architecture: Why a Cited Answer Can Still Be Wrong.

The free five-page playbook in the Frameworks library turns it into a worksheet for your own stack — the capability-to-owner map, the five-failure diagnostic and the release test.

Reply and tell me who owns the withdrawal of a superseded document in your bank — not who approves the new version, who removes the old one from what the assistant can still retrieve. In most banks those are two different people and only one of them has been named. I read every response. Forward this to a banking executive about to sign off a grounded assistant on the strength of a demo.

Was this forwarded to you? Subscribe to The AI Architect Letter — free, every Saturday.

Minh Tran · AI Business Architect · LinkedIn · Workshops & advisory: aibusinessarchitect.ai