Context Provenance — Patterns

Provenance attached at admission, never reconstructed

Problem. After assembly the context is one block of text. Working out afterwards which producer supplied which paragraph requires matching strings against several stores, and it fails precisely for the transformed and merged spans that most need explaining.

Approach. Make origin metadata a required field on every candidate at the point it enters the assembler, supplied by the producer that created it. Reject candidates that arrive without it, rather than defaulting to unknown, so a producer that was never wired up fails visibly instead of contributing anonymous text.

Trade-off. Every producer has to be modified, including the ones written long before this requirement, and the strict rejection blocks paths that worked yesterday. The record also grows roughly in proportion to the context, so storage and retention decisions become real rather than incidental.

Derivation edges through every transformation

Problem. Compression, merging, and reformatting produce new text whose provenance is the union of its inputs. Implementations typically keep the first input's record, which attributes a summariser's sentence to one arbitrary source document.

Approach. Treat any transformation as producing a new span that references the identifiers of the spans it consumed, together with the name and version of the transformer. A derived span is then explicitly derived, with a resolvable path back to original material, and anything presented to a user as a quotation can be required to have a derivation depth of zero.

Trade-off. Derivation chains grow and are expensive to traverse, and a span assembled from forty inputs has a technically complete record that explains nothing. Requiring zero-depth provenance for quotations also rules out the paraphrased citation that is often what a reader actually wants.

Citations validated against the record

Problem. Asking a model to cite its sources produces citations that are well-formed, specific, and sometimes unrelated to what was in its context — including references to documents that exist but were never retrieved.

Approach. Give each admitted span a short opaque marker, instruct the model to cite by marker, and resolve every marker in the output against the provenance record before the answer is rendered. Unknown markers are a validation failure to be handled explicitly; the human-readable title and link are produced by the resolution step and never by the model.

Trade-off. Markers consume tokens, clutter the context, and are occasionally reproduced in the visible answer. The approach also only validates that a cited span was present, not that the claim is supported by it, so it detects fabricated references and not misattributed ones.

Stable source identity independent of indexing

Problem. Provenance records point at chunk identifiers from the retrieval layer. The corpus is re-chunked after a pipeline change and every historical record points at nothing, which is discovered during the first incident that needed them.

Approach. Record a composite identity: the durable identifier of the underlying item in its source system, the version of that item at retrieval time, and the offsets or hash of the fragment used. Index-local identifiers may be recorded as well for convenience, but resolution is defined against the durable pair so that re-indexing changes nothing.

Trade-off. Not every source system offers a durable identifier or a version, and for those the composite degrades to a hash that proves what the text was and cannot find it again. Keeping offsets also ties the record to a parse of the document that may not be reproducible later.