Every vendor blog explains how a citations API works. Almost none state what it does not promise — and the gap between those two things is the entire enterprise problem.
The primitive does one thing
The Citations primitive chunks the source documents you supply into sentences, matches each claim in the model’s output to the chunk that supports it, and emits citation blocks carrying the quoted text and its location. The engineering is clean: quoted text is not billed as output tokens, the feature is incompatible with structured outputs, and scanned PDFs without extractable text are not citable. Anthropic reports its built-in citations beat custom prompt-based implementations on recall by up to 15%, and an integrator reports source hallucinations falling from 10% to 0% with a 20% lift in references per response — figures that are first-party and, for our purposes, unverified.
Strip the marketing and the guarantee is narrow and exact: a claim is traceable to a chunk you supplied. Not that the chunk is authoritative. Not that the quotation holds against the real source. Traceable to your own input. That is grounding in the retrieval-augmented sense — a real, useful property. It is simply not the property a regulated enterprise means when it says a citation is “faithful.”
What “faithful” actually requires
The enterprise obligation is different from the primitive’s guarantee, and the mature assemblies admit it in their design. In Claude for Legal, Anthropic makes the seam explicit: cites resolved through a research connector are tagged with the source, cites drawn from model knowledge alone are flagged [verify], and if no connector is attached, a reviewer note records that sources were not verified. Thomson Reuters’ CoCounsel takes the closed-content route — a citation ledger validated against Westlaw and KeyCite signals. Two different assemblies, one shared admission: faithfulness is built around the primitive, not inside it.
The shape is always the same — retrieval, then the primitive, then verification and provenance, then an audit trail — and every property a board actually cares about lives in the last two stages. The primitive is a component. Assurance is the system.
Three ways verification fails
The characteristic failure of a naive assembly is collapsing three distinct outcomes into a single [verify]. They are not the same risk, and treating them alike is how an authoritative-sounding system ships an indefensible cite.
Conflict. The connector resolves the cite to a real authority, but the quoted language or proposition does not hold — a misquote, a wrong pincite, a bad treatment. This is checked and failed. It must route to human quarantine and must never ship as [verify], because [verify] reads to a reviewer as “unchecked,” which is the opposite of what happened.
No-match. The connector returns nothing. A single miss cannot distinguish a genuine corpus gap from a hallucination, so the honest state is unresolved; the cite stays [verify] and propagates with the reviewer note — but only after fallback connectors are exhausted, so a transient miss does not harden into a permanent flag.
Connector-down. Timeout, auth failure, outage. This is an infrastructure signal, not a content signal. Treat it as “no match” and an outage silently downgrades every cite to shippable-with-flag. Fail closed.
Whether any non-green cite is allowed to ship is then a risk-tier decision — a filing blocks on anything unresolved; an internal memo may ship it with the count surfaced — and that is a policy control, not a model behavior.
The ledger is the assurance artifact
The defensible claim is never “the cite is right.” It is “the system tried, recorded what it got back, and put a human on notice.” The immutable ledger entry — reachable? matched? confirmed? resolved to a tag, a reason, a timestamp, a resolver — is the artifact that converts a shipped [verify] from a latent liability into a documented, reviewed decision. This is assurance as an evidentiary property, not a correctness property, and the distinction is the one that survives an auditor.
The legal reality makes the stakes concrete rather than theoretical. Bar guidance — ABA Formal Opinion 512 (July 29, 2024) — grounds permissible AI use in the existing duties of competence, supervision, and candor to the tribunal, rather than inventing a new regime. An architecture that cannot produce the evidentiary record cannot discharge the supervision duty. The ledger is not a nicety; it is the mechanism by which the obligation is met.
The anti-pattern: a validator wired to nothing
A public Citations workshop diagrams the pipeline as query → citation processor → store → API → citation validator. The validator validates against nothing: no external authority, no provenance tier, no audit trail. It is a clean specimen of the gap this reading is about — an authoritative-sounding validation step that, left undefined, gives a risk committee exactly nothing. The assembly described here exists to give that step something real to check against, and a record to leave behind when it does.
The architectural implication runs one level down: the audit ledger is the component that actually carries the assurance argument, and it earns a first-class design — decomposed, owned, and instrumented — rather than a single box on a diagram.
Citation faithfulness is an assembly property, not an API feature. The primitive guarantees precisely one thing — traceability to a chunk you supplied — and an enterprise that mistakes that guarantee for faithfulness has bought grounding and shipped it as assurance.
Everything a board must defend — that the source is authoritative, that the quotation holds, that a failure to verify is visible rather than silent — is engineered in the verification, provenance, and audit stages built around the primitive. Buy the primitive. Build the assurance.
