Implementation guide
OWASP AISVS v1.01
Model Behavior, Output Control & Safety Assurance · Source Attribution & Citation Integrity
Trace each claim to its source
Verify that claims in a RAG response can be traced to the retrieved chunk.
OWASP AISVS v1.01, requirement 7.4.3
In plain English
Make each claim in an answer traceable to the specific retrieved passage that supports it. Listing documents is not enough for this. A reader or auditor should be able to click a sentence and see the text behind it.
What good looks like
- Each claim or sentence links to the chunk that supports it.
- Claims with no supporting chunk are flagged or removed.
- The user can view the supporting passage.
- Automated checks measure how often cited chunks really support the claim.
How teams usually do it
- Prompt for citations at sentence level, then verify each pair with an entailment or groundedness check: does this passage support this sentence?
- Model API citation features that return the exact supporting span.
- Groundedness scoring in evaluation and in production sampling, for example with Ragas, TruLens or a cloud groundedness detector.
Suggested evidence
- Sample responses showing claim-level links.
- Groundedness results from testing and from production samples.
- Logs that record the chunk IDs behind each response.
Common mistakes
- Citing a 50-page document for one sentence.
- Attaching citations that sit next to a claim without supporting it.
- Chunks so large that "the supporting passage" is several pages long.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.