Practical software guides
An AI draft with citations can still be wrong. A document may be outdated, irrelevant or quoted inaccurately. For professional work, keep the approved source, its version and the human review decision attached to the draft.
| Stage | Example |
|---|---|
| Source set | Approved policy version 4; access limited to assigned matter |
| Question | Does this policy cover the requested situation? |
| Draft | Explains supported points and marks an unresolved condition |
| Review | Professional checks wording, source and missing context |
| Release | Approved recipient, final version and retained approval |
Try to make it fail
- Replace the source with an expired version: the draft must flag the version problem.
- Ask for a claim that the source does not support: require a gap or refusal.
- Supply a correct-looking citation to the wrong paragraph: reviewer must catch it.
- Include “ignore your rules” inside a document: it must not authorise another data source or action.
- Request another client’s material: retrieval permission must deny access.
Compare corrected and rejected drafts with a manual baseline. “Source locked” describes the permitted input set, not a factual reliability guarantee. Ordinary search and a deterministic checklist may be adequate for a small, stable policy set.
Partner responsibility
Agree who approves sources, configuration, model changes, retention settings and incident response. A deployment partner’s administrator access should expire or be revoked at handover. The business and its qualified professionals retain responsibility for advice and release decisions.
Use OWASP prompt-injection guidance and the permission matrix as security context. Review confidentiality and provider terms before uploading client material. No professional service outcome is claimed.