Grounding AI answers in governed sources
Compliance teams are being asked a new question: if an enterprise assistant answers a policy question, where did the answer come from? For a regulated organization, "the model just knew" is not an acceptable provenance. Grounding — tying each answer to identifiable source documents — is what turns a plausible answer into a defensible one.
Two very different mechanisms
It helps to separate two things that often get called "grounding." One is retrieval from an index: the assistant consults a curated, pre-crawled collection of documents that an organization has chosen to trust. The other is a live fetch: the assistant reaches out to a URL at the moment it answers. They have different governance profiles.
An index answers from material the organization has already vetted. A live fetch answers from whatever a URL returns at request time.
For most compliance use cases, indexed grounding is the safer default. The set of sources is known in advance, can be reviewed, and does not change between the time a control is tested and the time an answer is produced. A live fetch is more current, but it widens the trust boundary to include whatever is on the other end of the URL — which is exactly the surface a governance review is meant to close.
What to write into policy
We advise clients to state, in policy, which grounding mode an assistant uses for which task; to keep the indexed source set under the same classification and retention controls as any other record; and to log the sources cited in each answer so provenance can be reconstructed. Where a live fetch is allowed, it should be scoped, logged, and justified — not left as an ambient capability.
Why it lands in a disclosure conversation
None of this is abstract. When an auditor asks how the organization knows an assistant's answer reflects current policy, the answer is the grounding design: the index that was consulted, the controls on that index, and the log that ties the answer back to a governed source. That is the same evidence trail we build for the frameworks our work aligns to.
If your team is introducing an enterprise assistant into a regulated workflow, the grounding design deserves the same scrutiny as any other control. It is, in the end, a records question wearing new clothes.