In published tests, up to half of AI-generated citations are fabricated. Most RAG setups pipe raw fetches straight into prompt context: no record of where content came from, no defense against SSRF, nothing to hand an auditor who asks for receipts. Every claim this pipeline retrieves carries an audit trail instead. Receipts, not proofs.
This guide and reference implementation teach the provenance-first retrieval architecture we run in production today: bounded fetching, transport-layer provenance, and explicit degradation states. Built for engineers who will sit in front of an auditor.
When downstream systems rely on retrieved context, a broken citation is not an edge case. It surfaces in court sanctions and in statutory enforcement.
In published tests, 11–57% of AI-generated citations are fabricated across tested models: non-existent URLs, hallucinated DOIs, or real URLs pointing at unrelated content.
Cross-model citation-fabrication studies, 2024–2026 aggregates [B]Transparency duties under the EU AI Act fall in the tier carrying fines up to €15M / 3% of total worldwide annual turnover, in force since August 2, 2026.
EU AI Act Art. 99(4)(g), via EC AI Act Service Desk [A]Attorneys sanctioned by a federal court for filing ChatGPT-fabricated case law, submitted without verification of what the retrieval actually returned.
Mata v. Avianca, 678 F. Supp. 3d 443 (S.D.N.Y. 2023) [A]{
"artifact_sha256": "9f86d081884c7d65…",
"fetch_timestamp": "2026-08-24T14:02:11Z",
"http_status": 200,
"tls_cipher": "TLS_AES_256_GCM_SHA384",
"egress_policy": "allow-list:matched",
"cidr_validation": "public-range:pass",
"citation_state": "VERIFIED"
}
An architectural guide plus a sanitized reference implementation based on the same architecture running in production. Receipts, not vibes.
Why naive RAG pipelines fail verification audits, and how to build a bounded, telemetry-backed retrieval layer that holds up under compliance scrutiny.
A reference fetch worker with explicit IP egress guards, DNS rebinding mitigations, response-size ceilings, and strict domain policy enforced before any payload reaches memory.
A structured format binding raw payloads to SHA-256 digests, ingress timestamps, routing metadata, and transport headers, ready for downstream audit logging.
Explicit transitions between VERIFIED, DEGRADED, and FAILED states, so stale or broken citations cannot pass silently into model context. Telemetry exports to your existing observability stack.
Reliable retrieval is an active engineering space, and other projects attack adjacent parts of the problem:
Kerynex Artifact Relay teaches the retrieval-transport boundary: SSRF-safe bounded fetch, SHA-256 artifact hashing, transport-provenance schemas, and citation degradation states with native telemetry. Both projects are credited and contextualized in the guide's related-work section.
This is paid early access through Gumroad. Here is the whole deal before you decide anything.
You pay now; the bundle ships when built. If the early-access validation gate misses its threshold, purchases are refunded in full to the original payment method. Educational product: not legal advice, not a compliance certification.
Draft preview — purchase control is intentionally inert. Target mechanism: Gumroad paid early access.