Grounded means cited or declined
- A grounded AI system is defined by its outcome contract, not its retrieval pipeline. Cite approved evidence, state uncertainty, or decline. Log which one happened.
- Vendor RAG (retrieval-augmented generation) pipelines run from ingestion to generation, and citation primitives exist on the major platforms. The enforcement, the decline policy, and the logging are the builder's job.
- The standard exists. NIST's generative AI profile names confabulated citations as a risk, and defines high-integrity information as source-linked with acknowledged uncertainty.
- The default posture fails it. In a March 2025 study that ran 1,600 news-lookup queries through eight consumer AI search tools, over 60% of answers were wrong, and ChatGPT never once declined to answer.
- Test with questions your corpus cannot answer. A system that answers them anyway is not grounded, whatever the architecture diagram says.
The enterprise AI prototypes I get asked to evaluate share a talent: they answer smoothly. That is the problem. Ask the team a harder question, why should anyone trust this specific answer, and the demo goes quiet. The word doing the heavy lifting in these conversations is “grounded,” which in most pitches means retrieval got wired in. The evidence says that is not enough. In March 2025, the Tow Center at Columbia ran 1,600 test queries across eight AI search tools and got wrong answers over 60% of the time, delivered confidently. ChatGPT flagged uncertainty in just 15 of 200 responses and never once declined to answer.
Those are consumer search tools on an artificial news-lookup task, so carry the digits with care. The posture is the finding. Confident answering is the default behavior of this technology, and retrieval alone does not change the posture. A contract does.
The doctrine
Grounded means cited or declined. For any consequential claim, the system cites approved evidence, states its uncertainty, or declines to answer. It logs which of the three happened. Everything else in the architecture serves that contract.
That is my doctrine for custom AI systems, and this article is the build-side companion to the measurement-side citation gate I apply to AI research. Here is why the contract is the definition, where the standard comes from, and how to test any system against it in an afternoon.
Retrieval is a component. Grounding is a contract.
Look at what the vendor stack actually ships. RAG, retrieval-augmented generation, is the standard pattern of fetching approved source material for the model to answer from. Google's Vertex AI RAG overview (updated July 2026) describes the pipeline plainly: ingest data, transform it, embed it, index it, retrieve against the query, generate. Six steps, ending at generation. As their documentation stands in mid-2026, OpenAI's file search tool can attach file citation annotations to responses, and Anthropic's citations capability can return the exact passages supporting each claim. The primitives are genuinely good, and none of them decides your policy. Nothing in the pipeline says which claims require evidence, what happens when retrieval comes back thin, when the system must say it is unsure, or when it must refuse. Those are design decisions, and if nobody makes them, the model's default posture makes them for you: answer smoothly, every time.
The standard already exists
The federal risk profile for generative AI, NIST AI 600-1 (July 2024), names the failure mode precisely. Confabulation: systems that “generate and confidently present erroneous or false content.” It goes further, warning that outputs “may also include confabulated logic or citations that purport to justify or explain the system's answer,” and notes such risks “may be especially important to monitor” in “applications involving consequential decision making.”
The same profile defines what good looks like. High-integrity information “distinguishes fact from fiction, opinion, and inference; acknowledges uncertainties,” and “can be linked to the original source(s) with appropriate evidence.” Read that twice and the contract writes itself: source linkage plus acknowledged uncertainty, per answer. OWASP's 2025 LLM Top 10 ranks misinformation as a core application vulnerability (LLM09) alongside improper output handling (LLM05), which is the security community saying the same thing in its own register: unsupported output is a system defect, not a style problem. Cited-or-declined is my operationalization of those standards, and I hold it as doctrine because nothing weaker survives contact with a compliance review.
The Cited-or-Declined contract
The contract has three outcome states. A consequential claim, in this contract, is any answer someone will act on with money, health, legal standing, or reputation at stake. Every consequential answer lands in exactly one state, and the state is logged.
| Outcome state | What it requires | What the user sees | What the log records |
|---|---|---|---|
| Cited | Every consequential claim bound to approved evidence that was actually retrieved | The answer with its sources, openable and readable | Claims, sources, retrieval trace |
| Uncertain | Partial or conflicting evidence, stated as such | A qualified answer that names what is unknown | The gap, the conflict, the qualifier shown |
| Declined | Evidence missing, stale, or out of scope | A refusal that says why and what would unlock an answer | The unsupported question, as data |
Two policies complete it. The source boundary comes first: an explicit, versioned definition of what the system is allowed to treat as evidence. In practice that looks like a list: these 214 policy documents, this product catalog as of this date, nothing else. Without it, binding claims to sources just produces traceable nonsense. And exceptions fail closed and visibly: when a system must answer outside the contract (a general-knowledge fallback, a summarization mode), the output is marked as uncontracted, never dressed as a grounded answer.
Test it with questions the corpus cannot answer
You do not audit this contract by asking questions the system handles well. You audit it with the unsupported-question matrix: out-of-scope questions from a neighboring domain, plausible adjacent questions one step past the corpus edge, stale questions whose source has expired, and ambiguous-entity questions where two things share a name. Run each class through the system and record the outcome state. Here is the shape of one test, hypothetical on purpose. Your corpus is your own policy library; the prompt is “What is our travel reimbursement limit for contractors?” when the policy only covers employees. The cited outcome would be wrong by definition. The passing outcomes are uncertain (“the policy defines employee limits; contractor terms are not in my sources”) or declined, and the log records the gap either way. A grounded system states uncertainty or declines, and its log shows those non-answers as first-class records. A system that answers everything has already failed, whatever its architecture diagram says. Declined answers are data: every logged refusal is either a corpus gap to fill or a boundary working as designed, and the log is where the next quarter of system improvement comes from.
What I run in production
This doctrine comes from operating it, and from both sides of the consequence line. The production research engine I architected runs the full contract: findings are citation-gated, evidence that fails its checks is dropped rather than patched, sources are classified, and refusals and incomplete states are recorded as explicit outcomes instead of being papered over with a confident paragraph. The anti-fabrication gates exist because the failure NIST describes, confabulated support for a wrong answer, shows up in real runs if you do not structurally prevent it.
And the honest contrast: the chat agent on this website is context-grounded against compiled, approved site content, and it does not show per-answer citations. That is a deliberate contract choice for a bounded, low-consequence context where every source is already public on the surrounding pages. The two systems are not the same architecture, and I say so on purpose. Consequence level decides the contract. A marketing agent can run grounded without per-answer citations; a system answering compliance, financial, or clinical questions runs cited-or-declined or it does not ship.
Where citation ends
The contract's limits, stated plainly. A citation proves traceability, never truth: NIST warns citations themselves can be confabulated, and the Tow Center found fabricated links in the wild, so the evidence behind a citation has to be openable and worth opening. Source quality is a separate discipline the contract depends on. And declining has a real cost: a system that refuses too often gets routed around by its own users, which is why the contract applies to consequential claims, with thresholds set by what an answer can break. The goal is a system whose confident answers have earned the confidence.
If you are building or buying a system that will answer questions that matter, write the outcome contract before the architecture review, and make the vendor show you the declined state working. A system that cannot decline cannot be trusted to cite.
Questions worth asking next
What does the cited-or-declined contract mean for an AI system?
It is the outcome contract I hold custom AI systems to. For any consequential claim, the system must do one of three things: cite the approved evidence behind the claim, state its uncertainty explicitly, or decline to answer. And it must log which of the three happened, so every important answer has an inspectable record. Retrieval, embeddings, and vector search are how a system finds candidate evidence. The contract is what makes the result trustworthy.
Does RAG stop AI hallucinations?
No. Retrieval-augmented generation reduces fabrication by giving the model relevant source material, and it remains only one component. NIST's generative AI profile notes that systems can confabulate the citations themselves, and a March 2025 study of eight consumer AI search tools on news-lookup questions found over 60% of answers wrong, delivered confidently. A system is grounded when unsupported answers are structurally prevented from shipping as confident claims: evidence binding, uncertainty states, and a decline path, enforced and logged.
How do I test whether an AI system is actually grounded?
Ask it questions its approved sources cannot answer, and watch what it does. Use out-of-scope questions, plausible adjacent questions, stale questions where the source has expired, and ambiguous ones where two entities share a name. A grounded system states uncertainty or declines, and its log shows the non-answer as a recorded outcome. A system that produces a smooth, confident answer to a question its corpus cannot support has told you everything you need to know.
Sources
- NIST, "Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile" (NIST AI 600-1), July 2024. https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
- Klaudia Jaźwińska and Aisvarya Chandrasekar (Tow Center, Columbia Journalism Review), "AI Search Has a Citation Problem," March 6, 2025. https://www.cjr.org/tow_center/we-compared-eight-ai-search-engines-theyre-all-bad-at-citing-news.php
- OWASP GenAI Security Project, "LLM Top 10 (2025)". https://genai.owasp.org/llm-top-10/
- Google Cloud, "Vertex AI RAG Engine overview". https://docs.cloud.google.com/vertex-ai/generative-ai/docs/rag-overview
- OpenAI, "File search" tool documentation. https://developers.openai.com/api/docs/guides/tools-file-search
- Anthropic, "Citations" documentation. https://platform.claude.com/docs/en/build-with-claude/citations
About the practice behind this guide
I am Bob Michaels, a Web and AI Systems Architect in Austin, Texas. I have built the web since 1994, and today I run AI visibility measurement, complete web presence transformations, and custom AI system builds for organizations that want one accountable owner across all three. If you are scoping a system that has to answer consequential questions, the first step is a bounded architecture review against the contract in this article.
Evaluating me for an AI leadership role instead? The work record is here.