AI Architecture · Provenance

Witness, Not Oracle

Every AI component that feeds another AI component must return evidence packages — conclusions attached to exhibits — not verdicts. Requiring the quote turns a sub-tool from an oracle you have to trust into a witness you can check. It’s the only thing that keeps hallucination from compounding silently through your nested calls.

I have a small tool that reads the transcripts of my own coding sessions and answers questions about them. Not “find this function” — that’s grep. Questions like “why is this project using Postgres and not Redis?” The kind of thing that lived in a decision I made at 11pm eight months ago and never wrote down anywhere a search engine could find.

The first version answered the way a chatbot answers. It read the transcript, thought about it, and told me: “The project uses Postgres because the author wanted relational joins and durable storage.” Plausible. Probably even right. And completely useless to the thing that was going to consume that answer next — an ingestion agent trying to build a durable record of the project. Because that agent has no way to tell whether I actually said that, or whether the tool made it up. It’s a verdict. You either trust it or you re-do the work.

So I changed the sub-tool’s system prompt. One instruction, and I’ll quote it exactly because the wording is the whole idea: answer it with quotes, answer it with filenames as evidence packages. Now the same question comes back differently. The conclusion is still there — Postgres, not Redis — but it arrives with the verbatim line from the conversation where I reasoned it out, and a short list of files to look at: here’s the first one, here’s a README I wrote about it, and this was the PRD. Same model. Same question. A structurally different kind of answer.

That one change has a name worth being precise about, because it’s the missing rule for a class of system almost everyone is now building: pipelines where AI components feed other AI components. I converted the sub-tool from an oracle into a witness. An oracle returns conclusions. A witness returns conclusions attached to exhibits.

The handoff is where provenance dies

Start with why this matters more than it looks like it should. Most people meet AI hallucination as a single-shot problem: you ask a model something, it confidently invents an answer, you catch it or you don’t. The fix everyone reaches for is a better model, plus a fact-checker on the output. That framing is fine for one call. It falls apart the moment you chain calls.

And we are all chaining calls now. A sub-tool retrieves and summarises. A scout consumes that summary and explores further. A senior model consumes the scout and makes the decision. Every one of those boundaries is a handoff, and the handoff is the failure point, because the standard move is to summarise at the boundary — compress the exploration down to a verdict and pass the verdict up. That’s a lossy compression at exactly the wrong seam. The moment a sub-tool returns a bare conclusion, its evidence is gone, and everything downstream inherits a claim it can no longer check.

What happens next isn’t that errors stay put. They compound. As one engineering write-up on multi-agent failure puts it: “When you chain agents sequentially, errors often compound rather than cancel… A subtly wrong intermediate output passes through intact, and every downstream agent treats it as fact.”¹ Worse, they don’t just pass through — they get reinforced: “when one agent makes a confident assertion, others tend to align rather than push back… a hallucinated fact introduced early gets reinforced at every hop until false consensus is effectively locked in.”¹ The recent research literature calls this a structured phenomenon, not bad luck: hallucination in multi-agent systems “exhibits structured propagation rather than an isolated generation error,” and it gets harder to trace precisely because there’s no “observable semantically traceable propagation trajectory.”²

The arithmetic is brutal and worth internalising. Chain a document analyser at 92% accuracy to a data extractor that “rarely hallucinates” and a few more competent components, and one analysis found the end-to-end success rate lands between 20% and 40%: “This is error compounding. It is not an implementation bug. It is arithmetic.”³ That maps onto the raw hallucination rates too. Deepchecks’ 2026 benchmarks put extractive question-answering — the narrow, witness-shaped task of pulling an answer out of provided text — at 3–8% hallucination, while multi-step agent workflows blow out to 20–40% of tool-call chains.⁴ The nesting is where the damage lives.

Here’s the part that should stop you: a fact-checker on the final output cannot save you from this. If you score only the senior’s finished memo for groundedness, you’re checking the wrong thing. As one 2026 audit guide states plainly, “a groundedness score on the final output alone won’t catch a mid-chain retrieval failure” — the fabrication happened three hops back, inside a component whose exhibit you threw away.⁵ You cannot audit at the end what you stopped carrying in the middle.

A pipeline of oracles multiplies unverifiable confidence. A pipeline of witnesses preserves receipts end to end.

Why the quote works at generation time, not after

The oracle-versus-witness distinction is not new — it’s one of the oldest ideas in the law of evidence, and the parallel is exact. When a jury returns a verdict, it gives no reasons: as a 2026 Harvard Journal on Legislation piece observes, “the fact that the jury produced the answer is the source of its legitimacy.”⁶ That’s an oracle — it’s authoritative because of who rendered it. Evidence is the opposite: a document or a witness statement earns its standing because it “can survive evidentiary checks and adversarial challenge.”⁶ One asks for faith. The other invites you to check.

Now the mechanism, which is the genuinely useful part. Requiring the exhibit doesn’t just make the answer checkable after the fact — it suppresses the fabrication as the answer is generated. When you force a model to select and reproduce the supporting quote before it commits to a claim, the quote constrains the claim. The model can’t drift far from text it has to reproduce verbatim alongside what it’s asserting.

This is measured, not hoped for. The attribution research that named the standard — AIS, “Attributable to Identified Sources”⁷ — has a concrete implementation that puts the quote first. In the ACL 2024 FRONT/G3 work, the model is made to “extract supporting quotes from the source documents… which in turn guides the generation of attributed answers,” and the reported result is direct: “the direct extraction of quotes from sources significantly reduces… the risk of hallucinations,” and the approach “significantly reduces hallucinations and benefits user verification.”⁸ Select the quote, then let it steer the claim. That is the witness convention stated in machine-learning terms.

The verbatim requirement buys a second thing, quietly: a deterministic verifier that no hallucinating judge can fake. A fabricated quote either exists in the source or it doesn’t — and, as one grounded-retrieval system notes, “a fabricated quote should be caught by string matching — not by an LLM that might hallucinate agreement with a hallucinated quote.”⁹ You get a cheap, dumb, reliable gate in front of every expensive probabilistic one. And the exhibit preserves the load-bearing qualifier a summary drops: a system that keeps “the verbatim quote as a grounded artifact” to prevent “hallucinated reconstructions” catches the difference between “use type hints” and “use type hints everywhere” — exactly the word a paraphrase loses.¹⁰

The framing I like best comes from outside my own work: grounding “transforms an LLM from a creative writer into a reference librarian.”¹¹ A librarian doesn’t tell you the answer and expect applause. She hands you the book, open to the page.

Decision archaeology as a tool call

Come back to the transcript tool, because it’s the cleanest working example of the convention doing real work. The task is soft: reconstruct why something was built, from conversation data that includes code. There’s no parseable structure to exploit — the “why” of a decision is a comprehension product, not a field you can extract with a regex. This is precisely where a language model earns its cost, and precisely where it’s most tempted to confabulate.

The witness prompt tames that. Ask “what was the author trying to achieve, and why Postgres and not Redis?” and the tool walks the conversation, reasons over it, and returns the conclusion with the quotes it rests on and the files as exhibits — the README, the PRD, the specific exchange. I think of it as decision archaeology as a tool call: the reasoning behind a past choice, retrieved on demand, in quotes, with the dig sites marked. This isn’t exotic; the research world is converging on the same shape. A 2026 system for exactly this problem — extracting “Decisions, Facts, Insights” from long conversations — does it by “preserving exact source quotations, enabling traceable and hallucination-tolerant retrieval.”¹⁰ Same instinct, arrived at independently: the decision is only worth retrieving if it comes with its receipt.

The property that makes those receipts trustworthy is when they were created. The pointer from a claim to its source isn’t generated later to justify an answer already given — it’s the residue of the actual reading. The claim exists because that file was read, on that date, by that pass; the tool’s own transcript of the walk is the witness statement, sitting in the archive if anyone ever asks. Provenance is a property of the process that produced the claim, not a garnish added to the output. (I’ve written the human-facing version of this idea separately — Trust Is a Link You Can Click — where the same receipt is something a person clicks rather than something the next model ingests. Same doctrine, different consumer.)

The evidence-package schema

What actually crosses the wire? Not a paragraph of prose with some links stapled on. An evidence package is a small, regular structure — and I’ll show a shape rather than claim a standard, because the point is the discipline, not the exact field names. A witness-grade return has four parts:

That fourth field is the one people skip, and it’s the one that makes the whole thing compose. A witness that declares its own uncertainty lets the senior spend its expensive attention exactly where the exhibits are thin. External practice is converging here too: production teams building agent-ingestible “Evidence Packs” — where “every number has a receipt” and an agent can “ingest an Evidence Pack, verify the checksums, reference it later, justify downstream actions” — have found the same discipline, right down to the confession: “disclosing what you didn’t capture is how trust gets built. Any AI audit trail that only reports successes is hiding the interesting stuff.”¹²

Now watch one nested chain with and without the format, because the difference is the whole argument:

This is the same reflex our own retrieval architecture already runs at the data layer — hard numbers are kept out of the reasoning and the system “knows exactly which raw source to hit — no blind semantic search over numerical data, no hallucinated statistics.”¹³ The witness convention just generalises that reflex from numbers to every answer a sub-tool returns. It’s the same commitment as shipping the deliberation rather than the verdict — a system that can’t show its working is “an answer generator, not a reasoning partner.”¹⁴

What I am not claiming

Let me draw the boundary honestly, because the failure mode of a piece like this is to oversell the mechanism.

I have not run a controlled A/B on my own transcript tool. I changed the system prompt, the answers got dramatically more useful downstream, and I kept the change. That’s a field observation, not a measured confabulation-rate delta, and I’m not going to invent one. What I can point to is the external evidence that the direction is real and measured elsewhere: quote-first generation “significantly reduces hallucinations”⁸; and on the narrow witness-shaped task where “the correct answer sits inside the provided text,” Vectara’s hallucination leaderboard has top models scoring under 2%, against the far higher rates the same models post on open-ended, oracle-style tasks.¹⁵ The shape of my result matches the shape of theirs. That’s the honest weight to put on it.

A witness is checkable, not truthful. Quotes can be cherry-picked; an exhibit can be real and still misleading. The convention doesn’t make the sub-tool right — it makes it inspectable, which is a different and more achievable thing. The resolvable pointer is what turns “trust me” into “go look.” That’s the entire claim.

An evidence package is not an agent receipt. A receipt is process telemetry — what the agent did, which tools it called, what it cost. The evidence package is the answer itself: the conclusion-plus-exhibit that is the substance of the reply. They’re complementary. In fact, the witness convention is what makes a receipt’s “sources cited” field mean anything — otherwise that field is just another asserted claim.

And this isn’t the scout/senior handoff. I’ve written that pattern up as The Scout and the Senior — a cheap cached scout explores and freezes its transcript, a frontier senior inherits it and emits one governed decision. That work names the seam. This article names the format contract on the wire that crosses it — and on every nested wire beneath the scout. The two fit together; the witness convention is the missing hard rule for the nested case that the handoff pattern assumed but never specified.

Install the convention

If you’re building anything where one AI call feeds another, this is the rule to adopt, and it’s cheap to adopt because it lives entirely in the interface between components — not in the models.

Every sub-tool that answers another AI component returns claim + exhibit + pointer. No bare verdicts on the wire. If a component can only give you a conclusion, treat it as an oracle and be suspicious. The exhibit is verbatim. Reproduced, not paraphrased — that’s what enables the deterministic string check and preserves the load-bearing qualifier. The pointer resolves. The consumer — human or machine — must be able to open it. A pointer that doesn’t load is theatre. The witness declares what it couldn’t verify. The confession field is not optional; it’s what lets the next hop aim its scrutiny. And the exhibit travels every hop. Don’t summarise it away at the first handoff to save tokens — you’re quoting the load-bearing line, not the whole corpus, and the corpus stays one pointer away.

None of this requires a smarter model. It’s the opposite bet: fix the interface, and a cheap component becomes safe to compose, because the expensive one downstream can always check its work. That’s the same move as preferring a reviewable artefact over an autonomous action — a structure the model can’t route around, rather than a behaviour you’re hoping it exhibits.

The stakes are why the rule has to be hard rather than nice-to-have. When an AI pipeline is caught in one confident fabrication, the blame doesn’t attach to the one bad hop — it attaches to the whole system, categorically and permanently. A single leaked oracle-claim, surfaced downstream, can poison trust in a pipeline that was right 95% of the time. Provenance that survives every handoff is the only thing that lets you say, when it matters: here is where that claim came from, here is the line, go and read it yourself. (I’ll take the failure-triage side of this — what happens when the exhibit contradicts the claim — somewhere else; that’s its own story.)

Chain oracles and you’re stacking hearsay on hearsay, each layer more confident and less checkable than the last. Chain witnesses and you keep the chain of custody: every answer arrives holding the thing that proves it. Same models, same pipeline, one convention on the wire — and the difference between a system you have to believe and a system you can check.

The oracle asks the next model to take its word for it. The witness hands over the quote — and the file it came from.