Enterprise Generative Search — Azure and Open Source  ·  View 03 of 41  ·  Context and scope

The Evidence Contract

The three rules the rest of the architecture is a consequence of.

Editable source SVG draw.io All views
Rule 1 — Nothing enters the context that the caller could not open themselves Enforced here Entitlement Resolver group set per request Index-side security filter never post-filtered ACL fingerprint in cache key SHA-256 of group set Therefore forbidden Model holding an index credential it requests, never queries One answer cache for all callers cross-principal reuse Rule 2 — Every sentence carries an evidence id the retriever minted, or it is not shown Enforced here Evidence ids minted at retrieval chunk plus version Claim to evidence binding verified, not requested Provenance persisted with every answer Therefore forbidden Model-written citations a string it can invent Unbound sentence rendered dropped or flagged Rule 3 — Retrieved content is data. Only the system prompt and the caller turn are instructions Enforced here Structural fencing evidence in a typed slot Injection screening at index and at query Tool broker with allowlist policy per query class Therefore forbidden Tool call sourced from a document never honoured Free-form model egress no open network Consequence — the CRM assistant needed no access model of its own Consequence — any answer replays and re-derives from its evidence ids The Evidence Contract — The Three Rules Everything Else Follows From The test of the contract: an answer that cannot be re-derived from its evidence ids is a defect, not a matter of style. v 1.0 · owner Data and AI Global Practice

The decision everything follows from

  • Rule 1 makes authorisation an input to retrieval rather than a filter on its output. The consequence is that the ACL fingerprint is part of every cache key, and that no component holds a credential that can read more than its caller.
  • Rule 2 makes provenance a data structure rather than a formatting convention. A citation joins a claim to a retrieval result, so any answer can be replayed and re-derived months later.
  • Rule 3 makes the trust boundary structural. Evidence occupies a typed slot that is never read as instruction, so a poisoned document is a ranking problem rather than a compromise.

How each rule is tested

  • Rule 1: a nightly assertion replays yesterday's answers under a stripped-down principal and fails if any evidence id is still reachable.
  • Rule 2: every answer in the golden set is re-derived from its stored evidence ids; a claim that cannot be re-derived is a defect ticket.
  • Rule 3: 220 adversarial documents are indexed into the fixture corpus, and any tool call whose provenance is a document body fails the build.

Risks

  • The contract erodes quietly. A well-meaning cache that omits the fingerprint, or a prompt that pastes evidence into the instruction block, breaks it without any test failing unless the tests above exist.
  • Claim-level binding costs latency and tokens. It is the single largest quality expense in the design and was justified against the alternative of a model writing its own citation strings.
◀  High-Level Architecture All views Query Classes and Routing  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 41 views · Microsoft Azure and open source03-the-evidence-contract