The Honest Limits

Prompt first: build the screen — and read its label

Build the automated grounding screen for eval runs:

For each answer, for each cited claim, ask a model - NOT the one
that wrote the answer - to grade: does the cited passage state the
claim? SUPPORTED / ADJACENT / ABSENT, with the passage quoted.

Output per run: every claim graded ABSENT or ADJACENT, ranked worst
first - this is the triage list for the human hand check.

Label the output exactly: "SCREEN RESULTS - triage for hand check,
not a verdict. A model graded a model; agreement is evidence, not
proof." Do not emit a pass/fail from this screen, and do not
compute an aggregate accuracy percentage from it.

The screen is genuinely valuable: it reads every claim when hands can only read a sample, and it ranks where the hands should go. The label is what keeps it in its place — and the reasoning behind that label is this lesson.

Why the judge cannot certify

If you took Building Trustworthy Data Products, you already own the rule: a check that shares failure modes with the thing it checks is not independent — two implementations reading the same source with the same logic produce the same wrong answer twice, in agreement.

A model judging whether a model’s claim is supported by a passage is that rule’s sharpest case. The judge and the answerer share the deepest failure mode there is: the way language models read text — the same tendency to accept adjacent-as-supported, blend qualifiers away, and find claims plausible because they are fluent. A different model helps at the margins; it does not manufacture independence, because the shared mode is the kind of reader, not the brand.

So the screen triages and the hand certifies. The pass bar includes a human-adjudicated sample, forever, and the screen’s own accuracy gets spot-checked against the hands — when the screen says SUPPORTED and the hands say ADJACENT, that disagreement is recorded, because it measures the screen.

What a pass actually licenses

Assemble the whole apparatus — retrieval eval, hand-checked support, refusals, conflicts, held-out set — and a full pass licenses exactly this sentence:

On this question set, at this corpus version, with this configuration, we observed no unsupported answers, no failed refusals, and no silent conflicts.

Every clause is load-bearing. This question set — thirty questions prove thirty questions; question thirty-one is inference, and the held-out set makes the inference reasonable, not certain. This corpus version — a document added tomorrow is unevaluated territory. Observed — not “the system is accurate,” which claims a property; you measured events. The site’s no-unsourced-numbers rule applies to the system’s claims about itself: “97% accurate” implies a population nobody measured, and the honest form is the sentence above.

And one limit stands outside the whole apparatus:

Grounding is fidelity to the corpus, not truth. The 2019 manual’s procedure was superseded by a bulletin nobody filed; the field note misidentified the failure; the filing contains a typo in a critical figure. The system answers faithfully from each — supported claims, perfect provenance, clean evals — and the answers are wrong, because the documents are wrong. Every check this training built measures the answer against the corpus. None measures the corpus against the world. That is the corpus owner’s burden (2.1’s statuses, 2.4’s versioning), it is unsolvable by anything in Modules 3 or 4, and a team that cannot say this sentence out loud will eventually say it in an incident report.

Bounding what remains

Some residual risk survives everything above: an adjacent claim the sample missed, a corpus document wrong about the world, question thirty-one. The honest response is not more checking — it is bounding the consequence, and that is a design decision, not a hope:

• Serving modes (Module 5’s decision): classes whose wrong answer costs a truck roll can answer directly; classes whose wrong answer reaches a regulator serve drafts with citations for a human who checks — the residual risk lands on a checker, not a decision.
• The record (Module 6): every answer traceable, so the wrong one that does land is investigated in minutes, not reconstructed from memory.

Stop and escalate when someone — a slide, a vendor, an enthusiastic sponsor — states the system’s reliability as a property (“it’s 97% accurate,” “it only answers from our documents, so it can’t be wrong”): the correction is this lesson’s licensed sentence, it goes to whoever owns the claim before it reaches a consumer or a customer, and making that correction is part of owning the system.

Key takeaway

The screen reads everything and certifies nothing: a model judging a model shares its failure modes, so triage is automated and the verdict stays human, forever, with the screen itself spot-checked against the hands. A full pass licenses one auditable sentence — no failures observed, on this set, at this version — never a percentage, never a property. Grounding is fidelity to the corpus, not truth, and no check in this training measures the corpus against the world. What remains gets bounded, not denied: serving modes sized to consequences, records that make the eventual wrong answer an investigation instead of a betrayal. Module 5 makes those serving decisions.

LEADERSHIP DECISION   fund the hand-check sample as a permanent
                      operating cost, and strike every reliability
                      claim stronger than the licensed sentence
PRACTITIONER ACTION   run the screen as triage, adjudicate by hand,
                      spot-check the screen against the hands, and
                      say "observed on this set" - never a percentage
SUCCESS MEASURE       every public claim about the system matches the
                      licensed sentence; the first wrong answer lands
                      inside a stated risk, not outside an overstated
                      one