Does your AI know where its answer came from?

Does your AI know where its answer came from?

An enterprise answer is not trustworthy because it sounds precise or displays a citation. It is trustworthy when a reviewer can reconstruct which evidence was retrieved, what version applied, how the system transformed it and where inference began. Provenance turns an opaque response into a reviewable chain of claims.

Design that chain below the interface. Record source identity, owner, effective date, jurisdiction, access classification, retrieval time and the exact passage supplied to the model. Version the query, ranking, prompt and model alongside the response. A link to a living document is insufficient if its content can change after the decision.

At answer time, separate sourced facts from synthesis and recommendation. Attach citations at claim level, expose conflicting or missing evidence and make uncertainty visible. Retrieval should respect the user�s permissions before content reaches the model; filtering the final text cannot reliably undo an unauthorised disclosure.

Provenance is not the same as truth. The C2PA standard for digital content makes this distinction explicit: cryptographically verifiable history can establish the source and integrity of assertions without judging whether those assertions are good or bad. Enterprise knowledge needs the same discipline�traceability plus independent rules for authority, currency and quality.

Measure citation precision, evidence coverage, unsupported claims, stale-source use, permission leakage and reproduction of past answers. Test deliberately conflicting documents and poisoned retrieval content. The aim is not to eliminate judgement; it is to give decision-makers enough lineage to challenge the answer before relying on it.