Citations are a product decision, not a feature
An answer without provenance is a rumour.
Every response from our query surface carries the objects it was assembled from. This is not a nice-to-have bolted on at the end; it is a constraint the retrieval pipeline was designed around, and it eliminated several architectures we would otherwise have shipped.
The constraint
If an answer cannot be resolved to concrete objects, we do not render it. Not "render it with a warning" — do not render it. That single rule rules out anything that generates prose from a fuzzy neighbourhood without tracking which records contributed.
We would rather return "I could not find enough support for that" than a confident sentence with no address.
What it forced
- Retrieval must be traceable. Every candidate that entered the context window is logged with its object id, even the ones that were dropped.
- Ranking must be explainable. A score is fine, but the score has to be reproducible from stored signals, not from a black box we cannot re-run.
- Answers must survive permission checks. Citations are re-evaluated against the requester's permissions at render time, not at index time.
The uncomfortable part
Users sometimes want a synthesis that no single object supports. "Summarise our thinking on pricing" has an answer, but it is assembled from eleven documents none of which says it. Our rule still holds — we cite all eleven — but the answer reads as more authoritative than any one source, and that is a real risk we have not fully solved.
The mitigation is presentation: grouped citations, an explicit count, and no citation collapsing. It helps. It does not make the problem go away.