# Retrieve information and verify citations

**Flow key:** `ai-retrieval-and-citations`

## Outcome

A user receives an answer based only on authorized sources, with citations that support each consequential claim and remain usable under change or revocation.

## Actors

- User
- Retrieval/index service
- AI model
- Source repository/permission service

## Preconditions and entry points

- Synthetic sources contain known answers, distractors, conflicts, injection text, and restricted documents.
- Expected claims and citation spans are defined.

## Required test data

Use synthetic, isolated, resettable data. Never use real credentials, payment instruments, private customer records, or production notifications.

| Data | Canonical valid seed | Critical variations |
|---|---|---|
| Query | `What is Project CARBON's launch date?` | empty, typo, multilingual, ambiguous, adversarial |
| Authorized sources | two synthetic docs with launch date `2030-04-15` | stale version, duplicate, conflicting |
| Restricted source | other-tenant doc with tempting answer | revoked after indexing, cached snippet |
| Injection source | document containing instructions to ignore policy | metadata/title injection, hidden text |
| Expected answer | known supported claim plus uncertainty rule | no-answer/abstention case |

## Canonical steps

Treat this as the ordinary successful path inferred from common product behavior. Adapt it to observed labels, business rules, APIs, and implementation evidence; do not invent a requirement.

| Step | User or system action | Expected evidence |
|---:|---|---|
| 1 | Submit the query in the intended user/tenant context. | Retrieval scope and filters derive from current authorization. |
| 2 | Retrieve and rank candidate passages. | Restricted, stale, duplicate, and injected content are excluded or safely handled. |
| 3 | Generate the answer. | Claims stay within evidence and uncertainty is stated. |
| 4 | Open each citation. | It resolves to the exact permitted source/version/passage supporting the nearby claim. |
| 5 | Change/revoke a source and repeat. | Indexes/caches converge; inaccessible citations do not leak content. |
| 6 | Repeat and compare runs. | Answer variation remains within fact, citation, and abstention tolerances. |

## Alternate paths

- Direct answer
- Multi-document synthesis
- No-answer abstention
- Conflicting sources
- Source permission changes

## Failure and recovery paths

- Restricted chunk leaks
- Citation points to unrelated passage
- Stale index wins
- Source injection controls model
- Link works only for privileged evaluator

## Completion oracle

- The stated outcome is true in visible UI and authoritative persisted state.
- Exactly one intended business result and no unintended side effect occurred.
- Identity, tenant, authorization, money/data, lifecycle, notifications, integrations, analytics, and audit agree where applicable.
- Refresh, retry, back/forward, and a second authorized read do not reveal a contradictory result.
- Any partial, delayed, canceled, failed, or unknown outcome is labeled truthfully and has a safe recovery path.

## Evidence to capture

- Entry context, actor, tenant, role, feature flags, locale, time zone, and initial identifiers/state.
- Step-level screenshots or DOM state plus request/response, correlation, job, event, and stable business IDs where available.
- Before/after authoritative records, versions, totals, permissions, lifecycle states, and downstream side effects.
- Notifications, audit events, integration deliveries, retries, deduplication, latency, and recovery evidence.
- Untested branches, unsafe-to-run cases, product decisions, and evidence tier.

## Product decisions to resolve

- Exact eligibility, required data, authorization, and validation rules.
- Which steps are synchronous, asynchronous, optional, skippable, reversible, or irreversible.
- Idempotency, concurrency, timeout, retry, cancellation, and compensation semantics.
- Retention, privacy, notification, audit, performance, accessibility, and localization commitments.

## Related CARBON items

- [ai search and retrieval](../../items/ai/ai-search-and-retrieval.md)
- [search](../../items/organization/search.md)
- [permission](../../items/automation/permission.md)
- [security](../../items/quality/security.md)

[Back to AI and automation flows](index.md)
