Reliable AI agents need evidence for answers and deterministic controls for actions. Retrieval can supply relevant material, but it does not guarantee that the model uses it correctly. The system must be able to decline unsupported requests and recover from a failed operation.
Make the source visible
For a hypothetical policy assistant, retrieve only documents the caller may access and attach revision information. Require the answer to identify its supporting passage. If documents conflict or no applicable rule is found, return that limitation instead of inventing a policy.
| Failure | Control | Acceptance example |
|---|---|---|
| Missing evidence | Refusal or human handoff | No applicable document exists |
| Wrong version | Revision and approval filters | Superseded policy matches the query |
| Unauthorized source | Retrieval access check | User requests another team's record |
| Hostile document | Tool permissions outside the model | File asks to send private data |
| Interrupted action | Durable state and reconciliation | Destination responds after timeout |
Treat documents as data
OWASP prompt injection prevention explains prompt injection risks and why text separation is not an enforcement boundary. A document's instruction to call another tool should not grant that capability. Validate tool arguments and results using business rules and caller permissions.
Record the actual outcome
An agent's statement that it sent a message is not delivery evidence. Store the destination's response and verify the required end state. Retrying a mutating action requires a plan for duplicate prevention and unknown outcomes.
Measure failures honestly
Track unsupported answers, source mismatches, unsafe proposals, refusals and human corrections. Do not claim that hallucinations have been eliminated by a prompt or a retrieval layer. NIST generative AI risk profile discusses generative AI risks, including confabulation, as matters to manage and evaluate.
For AI agents and integration, start with one task, explicit permission boundaries and a test set containing difficult cases. Expand after the measured workflow is useful and controllable.