Guided security lab

Retrieval Relevance vs Trust

A guided exercise on reading retrieval evidence correctly: separate relevance, rank and citations from provenance, current version, user authorization and purpose-specific source authority before relying on a retrieved answer.

Conceptual simulationIntermediate15 minutes2026-09-26

Conceptual simulation

This exercise uses authored, deterministic examples with fictional names and neutral synthetic claims. It runs no retrieval, embeddings, ranking, index, model or tools, and it does not predict how any real model behaves.

Step 3 of 63/6

Learning objectives

Distinguish relevance evidence from security and authority evidence.
Explain why rank, similarity and reranker scores can order candidates but cannot authorize or certify them.
Treat citations as traceability, not as proof of correctness, currency or authority.
Use application-side source identity, source category, version state, ACL and purpose-specific source-of-truth rules outside model text.
Recognize that an authentic source can still lack authority for the current purpose, and allow a bounded answer when all required dimensions align.

Prerequisites

RAG Prompt Injection lab (recommended)
Poisoned Knowledge Base lab (recommended)

Choose a scenario

Each fictional scenario shows retrieved content the model sees and, separately, the retrieval scores and the source, version, access and authority facts the application records. Reliance decisions belong to the application facts.

Top-ranked result from an unverified sourceThe highest-similarity item matches the question almost word for word, but the application has not matched it to a registered source. The model proposes presenting its synthetic claim as an official fact.Perfect citation to a superseded versionThe candidate answer cites its source precisely and the citation resolves. The application's version registry marks the cited version as superseded. The model proposes presenting it as current.Authentic source, wrong purposeCurrent, authentic product documentation mentions data retention. The user asks for the official compliance retention rule. The product docs are relevant but not the designated authority for compliance questions.Lower-ranked canonical sourceThe designated current source of truth for the question ranks third. A higher-ranked team note is more similar to the query but not designated. The model proposes a read-only answer from the canonical source.All dimensions align for a bounded answerA retrieved item is relevant, provenance-intact, current, designated for this purpose and readable by the user. The model proposes a bounded read-only answer with a citation.

Retrieval path and trust flow

Candidates are ranked by relevance, filtered by access, then checked against source, version and purpose rules. Components are system; documents and the model proposal stay variable.

Indexed itemVariable content->
Source registrySystem component->
Retriever and rerankerSystem component->
ModelSystem component->
Proposed answerVariable content->
Answer reliance policySystem component

Model-visible retrieved content

Retrieved text the model reads. Bracketed text marks a neutral synthetic claim, not real guidance.

Retrieved item r-31 (rank 1)
[synthetic factual claim] The support desk is staffed on public holidays.

Retrieval scores and application-side evidence

Recorded by the retriever, the source and version registries, the ACL and the purpose-specific source-of-truth rules outside model text.

Retrieval evidence: Rank 1, highest similarity and reranker score; this orders candidates by relevance only
Source identity: Not matched to a registered source; source category unknown
Approval state: None recorded
Answer policy: Only items from a registered, approved source category may be stated as official fact