These articles come from lessons learned while building Eterna Clarity and the operating system I use to run it.
One of the most reassuring things an AI can do is show you where its answer came from. Search the web. Retrieve the document. Cite the source. Point to the record that supposedly supports the decision. That is a real improvement over asking a model to answer from memory and hoping it remembers correctly.
It also creates a failure mode I did not fully appreciate until Eterna produced one in front of me: the source can be real, trusted and authoritative, and the decision can still be wrong.
The simplest version is this. The AI had multiple candidates it could select. It chose one of them and cited authoritative evidence as support. The evidence really was authoritative. The problem was that it was authoritative about something else. The verifier knew the source was allowed to carry authority. It did not yet know whether that source actually supported the specific candidate the AI had selected. That is a very different problem from a fake citation.
A trustworthy source is not the same thing as relevant proof
Humans make this mistake too. A signed purchase order can be completely authentic without approving every purchase in the folder. A current company policy can be authoritative without proving that a specific proposal was adopted. A bank statement can be genuine without proving that a particular invoice was paid. The evidence is not false. The relationship is false.
That distinction matters enormously in AI systems because retrieval and citations can make an answer look grounded even when the grounding is weaker than it appears. There are really several questions hiding inside the word “evidence.” Is the source genuine? Is it authoritative for this kind of fact? Is it current enough to use? Does it actually support the claim or action being proposed?
Eterna already had a deterministic gate for one of those questions. If a model wanted to make a selection in a protected decision path, it had to cite authoritative evidence. Fresh relational tests exposed the missing question: authoritative for what? A stale or proposal-status candidate could still borrow an unrelated authoritative evidence reference and satisfy the general rule. The model had not fabricated the source. The verifier had not accepted an untrusted source. The failure lived in the relationship between the two.
The most important part: I did not fix the model
My first instinct earlier in this project would probably have been to think in model terms. Better prompt. Better training example. Another fine-tune. Teach the model more carefully that one kind of source should not justify another kind of decision. That would have been the wrong layer.
Once the system already knows which evidence belongs to which candidate, there is no reason to ask a probabilistic model to rediscover that relationship every time. It is exact state. Software can enforce exact state better than a language model can remember a rule about exact state.
So the fix went into the Engine instead. Evidence records gained an explicit relationship to the candidates they support. In the current implementation that relationship is represented as supportsCandidateRefs. When the strict gate is enabled, a selection now has to satisfy more than “some authoritative evidence was cited.” At least one cited authoritative evidence item has to be deterministically bound to the exact candidate being selected.
If an evidence record claims to support a candidate that was never supplied to the decision in the first place, the request is rejected before inference. The model does not get an opportunity to explain its way around the contradiction.
That correction passed 31 focused tests. The full Local PC regression rerun finished at 369 total tests: 368 passed, zero failed and one intentional skip. The live runtime was reloaded and the new input contract was exercised against the running system. No model weights were trained, and the local semantic runtime remained stopped. The AI behavior improved because I removed a problem from the AI.
This gave me a much cleaner definition of what AI should own
That failure helped sharpen one of the most important boundaries in Eterna. The model is extremely good at things that are hard to specify mechanically: interpreting messy language, comparing ambiguous evidence, understanding what a document appears to mean, synthesizing several signals, ranking plausible options and recognizing when more information is needed. Those are semantic problems. I want AI doing them.
Other things are not semantic problems once the system already knows the answer. Whether an evidence reference exists. Whether it was verified. Which authority role it has. Which exact candidate it is bound to. Whether a capability is currently permitted. Whether the expected prior state still matches. Whether an operation already happened. Whether a write produced a real receipt. Those are state and contract problems. I want software doing them.
The mistake is asking one layer to impersonate the other. If I hard-code a giant hierarchy for every possible meaning of every source, the software becomes brittle and starts pretending it understands semantics. If I ask the model to decide whether exact IDs, permissions, transaction state and known provenance relationships are valid, I am paying an intelligent guesser to do bookkeeping. Eterna's hybrid Engine is built around that separation: deterministic software owns truth and consequence; semantic models own interpretation and proposal.
The AI can propose an action. It cannot make the action true by describing it
That sounds like a small wording distinction until AI starts using tools. A model can propose a typed next transition. The Engine then checks the things that should not depend on persuasion: authority, current preconditions, capability visibility, parameter schema, protected decisions, idempotency, expected prior state, evidence freshness, consequence and reversibility. Only after those checks can deterministic execution occur.
The same rule applies after execution. Model text saying something was written, deleted, approved, adopted or completed is not accepted as evidence that it happened. The system needs the actual operation result and, where the consequence matters, observation of the resulting state. This is one reason I have become much less interested in an AI sounding certain. Certainty is a communication style. A receipt is evidence.
The more capable the model becomes, the more important that distinction gets. A weak chatbot being confidently wrong is irritating. A capable agent being confidently wrong while it can change files, operate systems and influence real company state is a systems-design problem.
Every AI turn now has a check-in and a check-out
The same thinking eventually reached the conversation itself. A substantive Eterna turn does not begin by assuming the chat already knows the company. It resolves the current intent against the systems that actually own the relevant state, compiles the smallest evidence-complete working context, applies the capabilities and operating rules that belong to that task, and issues a turn contract. Then the reasoning and work happen.
Before the turn is handed back as complete, the other side of the contract closes. Durable writes and real side effects are recorded as such. Founder decisions remain founder decisions. Work that produced no durable change is allowed to say so. The system does not need to manufacture a memory merely because a conversation occurred.
The exact mechanics have evolved, but the mental model is simple: check into reality before reasoning, then check back into reality before claiming completion. The chat is not allowed to become the place where truth exists simply because the AI said something convincingly inside it.
This is becoming a frontier agent problem, not an Eterna-only problem
When I compared what Eterna was doing against current agent research, the overlap was striking. OpenAI's recent work on trustworthy evaluations makes the point that agent performance depends on the harness around the model, not only the model itself. Anthropic describes trustworthy agent behavior as a combination of the model, harness, tools and environment rather than a property of the model in isolation.
Recent research is getting even closer to the exact failure I ran into. Work this summer on provenance sensitivity in LLM-agent action selection points out that evidence can be relevant without being authorized to determine a particular action. ToolGate formalizes tool execution around explicit trusted state plus preconditions and postconditions instead of letting natural-language reasoning alone decide what can be committed. Other current provenance work is pushing toward fine-grained links between claims, evidence and actions rather than treating the presence of a citation as the end of verification.
I did not invent provenance, transaction guards or formal verification. Those are old and powerful ideas. What interests me is what happens when you take those ideas seriously around modern AI instead of expecting the model to absorb every reliability requirement into its weights. The result starts looking less like a smarter chatbot and more like an operating system around a fallible but extremely capable reasoner.
The universal rule is embarrassingly simple
A true fact does not prove every conclusion you can place beside it. That is obvious when another person does it. Somebody quotes a real statistic that has nothing to do with the claim they are making and you immediately feel the gap. Somebody produces a real document that does not actually authorize the thing they say it authorizes. The source can be impeccable and the argument can still fail.
AI does not get a special exemption from that logic because it can retrieve the document automatically.
For systems that only answer low-stakes questions, a citation may be enough to help a human check the work. For systems that are expected to choose, act, write, approve, route or change state, I think the standard has to be higher. The evidence needs a relationship to the exact decision being made, and wherever that relationship can be known deterministically, it should not depend on the model's confidence.
That is the architecture I want around AI: let the model do the part that genuinely requires intelligence. Make software prove the parts that do not. The AI can be wrong sometimes; that is an unavoidable property of using a probabilistic system. The company does not have to turn every one of those mistakes into reality.
AI disclosure: This article is based on my own Eterna build notes and experience. I used AI as a drafting and editing partner; I reviewed the final piece and stand behind the technical substance and claims.
Top comments (0)