Evidence Gates for RAG Agents: A Publication Contract for Factual Claims
A fluent answer is a candidate, not a verified fact. A retrieval-augmented agent should publish a material claim only when the evidence available for that turn supports the whole c…
Contents
This note presents a portable Evidence Gate. In the final model invocation, the agent drafts an answer, lists the claims needed to justify it, records supporting passages and unresolved claims, then chooses a normal or limited response. The runtime parses the structured result and publishes only the selected branch. This creates an enforceable publication path, but the model's own evidence record is not independent proof that its claims are true.
Quick guide
| Question | Short answer |
|---|---|
| What fails? | A relevant passage can be mistaken for support of a more specific or different claim. |
| What changes? | The agent exposes a claim–evidence ledger before its answer is eligible for publication. |
| What does the runtime guarantee? | It enforces the response structure and branch selection; an unchecked draft cannot leak through a parse failure. |
| What remains unproven? | A self-written ledger can cite the wrong entity or omit a relevant source. Semantic verification needs separate evaluation or another check. |
Worked example: before and after the publication gate
Consider an anonymized support question: “Can I collect my online order at a physical location?” The available material gave a broad location clue and passages about other pickup or logistics arrangements. It did not establish that this seller offered the requested pickup service, nor did it give a complete address, hours, or a notification promise.
| Claim the user would rely on | Before: observed ungated answer, paraphrased | After: gate-permitted answer, paraphrased |
|---|---|---|
| Pickup is offered | Asserted from nearby logistics text | Marked unconfirmed |
| Exact address and hours | Filled in from a coarse location clue | Omitted because no passage supplied them |
| Notification promise | Stated as a service commitment | Omitted because no source authorized it |
| User-facing result | A complete but unsupported set of instructions | “I cannot confirm the pickup option, address, or hours from the available information.” |
The after column describes what the contract permits; it is not a verbatim replay transcript or a controlled effect-size estimate. The observed failure illustrates why partial truth is dangerous: a real location clue and nearby logistics text made invented operational details look credible. It does not establish a population-level error rate.
The claim “pickup is available at location X during hours Y” is a conjunction. Evidence for a district, a different pickup service, or a rule saying “consult the website” does not entail that full proposition. A source-governance instruction tells the agent where to check; it is not itself the checked fact.
The Evidence Gate
The ledger makes the model's evidence assessment inspectable without exposing its draft to the user. For each material claim, it should record the source identifier, the relevant passage, and what remains unresolved. “Supported by the prompt” or “found in retrieval” is too coarse: the cited passage must support the claim's subject, value, and scope.
The runtime's responsibility is narrower and deterministic. It validates the output shape, enforces any required tool ordering, selects the declared branch, and never falls back to an unreviewed draft. A log message such as “response validated” therefore means contract validation, not independent fact checking. An application may add a separate verifier or a typed data lookup for claims whose risk of error warrants it; that extra layer must be evaluated on its own.
This pattern is domain-agnostic wherever an application can identify trusted evidence, intercept the final response, and fail closed. The trusted-source policy and the consequences of an unsupported claim remain domain-specific.
The crucial limitation: evidence can be misbound
A separate anonymized preview trace exposed a failure that a structural gate cannot rule out. A retrieved engineering passage clearly described variant B. The agent copied a true numeric specification from it into an answer about variant A and wrote a ledger quoting the number without preserving the variant label. The structured response passed validation, yet the claim was assigned to the wrong entity.
The same trace also contained a later question for which the agent abstained even though a relevant passage had appeared in an earlier turn. That passage was absent from the current retrieval. This is a retrieval-coverage problem: the abstention was defensible given the current context, but not maximally helpful across the session.
These are qualitative observations from one manually exercised preview session; the private trace is not a public benchmark. They illustrate two distinct errors:
- False support: retrieved evidence is real but belongs to a different entity, version, time, or scope.
- False abstention: the needed evidence exists in the corpus or history but does not reach the current decision.
A useful claim representation is (entity, relation, value, qualifiers). Evidence should match each material field, not merely contain the same keyword or number. Stable document and passage identifiers make that comparison auditable. When source conflict cannot be resolved, the answer should state the uncertainty rather than select the most convenient passage.
How to evaluate the pattern
A credible evaluation pairs each question with four evidence conditions: correct support, missing support, a near-neighbor passage, and conflicting passages. Hold the question and model settings fixed while changing only the evidence condition. Label the final claim and the cited passage separately, including entity and scope.
Report at least four outcomes: unsupported assertion rate, supported-answer coverage, unnecessary abstention rate, and claim–source attribution accuracy. For agents that act, also check whether the requested tool side effect occurred before the final response. Compare an ungated baseline, the self-reported gate, and any independent verifier on the same cases and repeated runs. A passing regression matrix in one setting is useful engineering evidence, but it is not a general guarantee of factual correctness.
This evaluation is motivated by prior work distinguishing retrieval from grounded generation [1], citation correctness from faithful source use [2], and abstention under missing versus misleading context [3]. A single-call gate is a practical response contract, not a replacement for those verification problems.
Conclusion
An Evidence Gate makes factual publication a visible decision: propose claims, map them to evidence, expose uncertainty, and allow the runtime to release only the selected response. Its strongest guarantee is procedural. To earn a stronger factual guarantee, a system must also test whether the evidence belongs to the exact claim and whether retrieval supplied the evidence that matters.
References
- Lewis et al., Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks, 2020.
- Wallat et al., Correctness is not Faithfulness in RAG Attributions, 2024.
- Setiawan, Prompt-Based Abstention Fails Under Misleading Context: A Controlled Study of Small Frozen RAG Models, 2026.
Comments are public in GitHub Discussions.