Ground answers in knowledge users can inspect
Retrieval is a publishing and operations problem before it is a model feature.
Read guide ↗Field 03 / Knowledge & actions
Ground it. Bound it.
An answer can sound grounded while using the wrong document, and an action can be schema-valid while still unauthorized. This desk follows the evidence path and the write path separately, then shows how to make both inspectable.
The question to keep asking
Which trusted component decides that this action is allowed?
A useful review starts here
- Untrusted documents cannot grant new authority.
- Citations support a specific, locatable claim.
- A retry does not silently become a second transaction.
- 01
Filter before context ↗
Keep identity and document permissions attached to retrieval.
- 02
Validate the proposal ↗
Check types, allowed values, business rules and current state.
- 03
Execute once, reconcile always ↗
Make retries safe with a stable operation identity.
See the source / related interface context
The workflow canvas became a debugging record.
Make the execution trace part of the product, not an afterthought.
Open the case file ↗This source capture illustrates a related interface—not evidence that the vendor passed these review checks.
The complete knowledge & actions desk
Go deeper.
Tools need permissions, not personality
Treat every external action as a typed, authorized transaction.
Read guide ↗
NVIDIA / Convai · source visual / reviewKnowledge & actions2 minDesign transactions for reversal
A conversational action needs the same rigor as a form—plus protection from ambiguity and duplicate turns.
Read guide ↗Privacy by conversation
Transcripts feel informal; they are still records containing identity, intent, and often sensitive detail.
Read guide ↗Knowledge freshness and document lifecycle: make retrieval expire on purpose
A governance loop for source ownership, effective dates, replacement, deletion, access changes, and answer verification.
Read guide ↗
Anthropic · source visual / reviewKnowledge & actions3 minPrompt injection at retrieval and tool boundaries
Treat retrieved text, attachments, web pages, and tool output as untrusted content before they can steer an action.
Read guide ↗Anthropic · source visual / reviewKnowledge & actions3 minMCP tool trust boundaries: protocol connection is not permission
Use Model Context Protocol tools without mistaking discovery metadata, tool descriptions, or a connected server for a blanket grant of trust.
Read guide ↗
Dify · source visual / reviewKnowledge & actions3 minRetrieval debugging: inspect the source before tuning the answer
A source-first investigation loop for finding whether a bad grounded answer came from ingestion, chunking, retrieval, context assembly, or response generation.
Read guide ↗Structured output validation: a schema is not a decision
Use typed output as a boundary between a model and a service, then apply the business checks that a well-formed object cannot know.
Read guide ↗Safe file-upload pipelines: a document is not trusted knowledge
Treat an uploaded file as untrusted material with a controlled path from receipt to extraction, authorization, retrieval, and eventual removal.
Read guide ↗Idempotent conversation actions: retries must not become repeats
Give consequential conversational actions a durable identity so a network retry, duplicate tap, or reconnect can report one operation rather than create several.
Read guide ↗Tenant-aware retrieval: authorize before assembling context
Keep isolation, revocation, and document scope at the retrieval boundary so a fluent answer never gets a chance to quote material the user cannot read.
Read guide ↗Citations as an evidence contract: locate, support, limit
A citation is useful only when a reader can find the cited material, see that it supports the claim, and understand where the evidence stops.
Read guide ↗Authenticate without putting secrets in the transcript
Keep passwords, recovery codes, and one-time codes inside purpose-built authentication surfaces while the conversation explains the transition and preserves the task.
Read guide ↗Knowledge owner review queues: resolve policy conflicts before the bot chooses
When two approved-looking sources disagree, route the contradiction to a named owner with evidence, a decision record, and a controlled propagation path.
Read guide ↗Editable confirmation summaries: corrections must reopen the right decisions
A review screen is trustworthy only when changing a field invalidates the confirmations that depended on it.
Read guide ↗Dates and time zones in booking conversations: confirm the local appointment, store the unambiguous fact
A booking dialogue must distinguish what a person means in their locale from the time-zone-aware value a service needs to check.
Read guide ↗Streaming tool-call assembly: execute only a finished call
Treat streamed tool arguments as an incomplete transport representation until a terminal event, one call identity, and current-turn checks make execution safe.
Read guide ↗Conversation cache invalidation: freshness is scoped
Cache only values whose audience, authorization, version, and freshness rule are explicit. This field note supplies an inspectable artifact, counterexample, and release checks.
Read guide ↗Corpus chunking evaluation: test boundaries before tuning retrieval
Choose chunk boundaries with controlled evidence fixtures instead of assuming one size or overlap works for every corpus. This field note supplies an inspectable artifact, counterexample, and release checks.
Read guide ↗Keep the system connected
Evaluation & operations Foundations Put the reading to work