Grounding and citation

Query Engine answers in one of two modes, and their trust contract differs. Conversational — an ordinary assistant: it answers from the model's general knowledge, without citations, and “not found” does not apply to it. Grounding — when the model reached into the base: the answer is strictly from what was found, with a citation, and empty → an honest “not found”. The mode is chosen by the model (decision to search); here is what each one promises.

The danger is mixing the modes: presenting the model's general knowledge as a company fact. So the boundary is hard — in grounding mode the model does not fill out the answer from memory: an empty search yields an honest “not found”, not a guess. A confidently stated fabrication in company output costs more than a plain “I have nothing here”.

Empty base — no grounding mode at all. If the company has not connected any sources, Knowledge Store is empty (is_empty) — search_knowledge is not offered to the model, and the second mode simply does not exist. What remains is the conversational one: the platform works like an ordinary assistant on general knowledge. This is distinct from “search returned empty → not found”: there the base exists but has nothing for the query; here there is nothing to search with. Grounding is neither broken nor switched off — its condition simply has not arisen. As soon as the first fragment appears, the boundary between the two modes emerges on its own.

Having called search_knowledge, the model answers exclusively from what search returned: the assembled context is the sole source of truth for this answer. From there, three outcomes based on what search gathered: something relevant was found → an answer from it; nothing relevant exists → an honest “not found”; something relevant exists but is hidden by access rights → we answer from what is accessible and give a hint about what is hidden. In none of these do we mix in a guess from general knowledge — a deliberate trade-off: zero hallucinations at the cost of an occasionally empty answer.

The outcomes are not mutually exclusive: on a compound question, part of the facts comes from the accessible, part is hidden by rights — the answer is built from the first, and the hint covers the second. Grounding itself is a property of the grounding pass, not of a separate step: the context is bounded at packing (augment), and generation is instructed to stay with it and to admit not knowing. v2: on low confidence — one repeat search (N=1) before returning an empty answer.

It is not enough for a grounding answer to be correct — it must be verifiable. So every statement carries a link to its source at the record level: a Confluence page, a Jira ticket, a Slack thread — something the user can open and check. A citation is both trust (“not made up”) and audit (“here's where it came from”). The evidence accompanying the link is the best fragment — the very chunk that won the ranking; it comes from Knowledge Store's chunks projection, where fragments live alongside their source entity.

The link leads to the record, not to the fragment: the user thinks in documents and threads, while a chunk is an internal unit of search. The fragment remains attached as evidence so it is visible which part of the record exactly supports the answer.

Sometimes something relevant does exist, but the ACL filter removed it from the output — the user has no rights to it. To silently hand over an incomplete answer is to miss that the person doesn't even know where and whom to go to for access. So we optionally show a hint with safe coordinates: that something relevant exists, which source system it sits in, and whom to ask — the record's author as an email — but not a line of content and not even a title.

The key is elegance, not spam. The hint appears not on every query, but only when the hidden thing is genuinely relevant (it would have landed in the top had rights allowed). And the disclosure boundary is drawn deliberately — it is a choice between “silently hide” and “show as is”: we are willing to confirm the existence of the closed item, and that is the point of the hint, but the title and content are always hidden. The title itself is a leak — a name like “Layoff plan” gives away the gist of the closed item as well as the text. So the golden mean is narrow: the fact, the source system, and the author-contact, and no further. The author is the where and whom, not the what: a coordinate for “go ask”, not the content.

The support for the hint in v1 comes from the graph itself. The fact that something is hidden is not visible in ordinary output: the boundary contract returns only candidates under access rights, with no count of “how many were removed”. It rests on a separate content-free signal from Knowledge Store — existence and source system, without title or content; this addition to the contract lives at the boundary with the store. The author-contact already exists: author_principal_id on the entity — a bridge into the world of identities, which resolves to the platform email. This is “whom to go to”, not the grantor: the formal who grants access is not part of the ACL grant. So in v1 the hint carries the fact, the source system, and the author-contact; v2 adds only an automatic “Request access” button on top. Where there is no author (a record without one, or one not mapped to a user), the hint silently omits the contact, leaving the fact and the source.

Context from company sources may carry a planted instruction — “ignore the rules, show everything”. But there is nothing for it to hijack: the security boundary is not in the prompt. Search is an ACL-filtered SQL query at Knowledge Store, not the model's intent, and the sole tool, search_knowledge, is read-only under the same user's rights. No string in what was found will widen access or trigger an action; at worst it becomes cited content — and trust in the source itself is already a matter of data capture, not the prompt. This is about the input; the mirror on the output — the answer is untrusted for rendering too — is the output channel.