Proofmark · field note · five ways to ship a wrong answer

How to guarantee your AI quotes a dead policy.

Every wrong-answer incident traces back to at least one of these five moves. So here they are, written as a recipe. Each step is a real, repeatable way to make your assistant cite a document nobody stands behind. Read the left column as the how-to. Read the right column for the exact mechanism in Proofmark that strikes it out.

published 2026-07 · 5 min read
THE RECIPE  the reliable way to fail ✓ THE MECHANISM  shipped: why the mechanism closes it
The recipe, in five steps
  1. Let nobody own the page.struck out ↓
  2. Let the checkmark survive edits.struck out ↓
  3. Let the newest copy win automatically.struck out ↓
  4. Let knowledge rot silently.struck out ↓
  5. Point the bot at all of it.struck out ↓

Ownership

Let nobody own the page.
The recipe step

Publish it, and assign it to no one.

An unowned page has nobody to notice when it goes wrong and nobody to answer for it, and, crucially, nobody to attest it. It sits in the knowledge base looking exactly as authoritative as the page a human signed.

The mechanismSHIPPED

No owner, no badge.

A knowledge unit cannot carry a verified badge without a named owner. Whoever attests a version becomes the accountable owner of record; unowned knowledge stays permanently unverified by design: it can be read, but it can never wear the mark. The absence of a name is the absence of the badge.

attestation state machine · owner required for the badge

The checkmark

Let the checkmark survive edits.
The recipe step

Get it verified once, then edit the body freely.

Change the refund window, the price, the effective date, and leave the green tick untouched. Now the badge vouches for words no reviewer ever saw, and the page reads as trustworthy precisely because it once was.

The mechanismSHIPPED

Edits kill the badge.

Verification is pinned to a specific content version. Any edit (including an upstream source change picked up on the next connector sync) drops the badge and routes the unit to the owner's queue for re-attestation. Verified is immutable per version: an edit doesn't quietly update a verified page, it mints a new, unverified one. The mark and the exact bytes it vouches for never drift apart.

verified immutable per version · edit → owner queue

Contradiction

Let the newest copy win automatically.
The recipe step

When two pages disagree, take the most recent one as truth.

No human looks; the freshest timestamp wins the tie. The dead policy that happened to be touched last quietly becomes the answer of record, and the version a person actually reasoned about gets buried under an edit.

The mechanismSHIPPED

Contradictions go to a human.

When a conflict is flagged, it lands in a Review Queue that shows both sides. A person picks which one is current. The machine never decides. The loser is deprecated and recorded as superseded, with the lineage kept, so the answer of record is one a human chose, not one a clock chose, and the decision stays auditable.

contradiction review → sunset loop · a human picks the winner

Freshness

Let knowledge rot silently.
The recipe step

Verify it once and never look again.

Knowledge has no shelf life, surely. Let the org chart, the on-call rota and the pricing page age quietly under a checkmark earned eighteen months ago. Nothing changes on screen, so nothing looks wrong, until the day it answers from it.

The mechanismSHIPPED

Freshness has a clock.

Each unit carries a review SLA. A scheduled sweep flips any lapsed unit to stale and routes it to the owner's queue: a queue, not a cleanup. Stale is treated as routine, not failure: it deletes nothing and raises no alarm, it asks the named owner to look again. Age becomes a visible, assignable state instead of an invisible risk.

freshness SLA sweep · lapsed → stale → owner queue

The agent

Point the bot at all of it.
The recipe step

Give the assistant the whole drive.

Every draft, every deprecated page, every doc nobody stands behind: one big index, no filter, no citation. Let it answer confidently from whatever it happens to retrieve, and let the reader guess which sentence came from something real.

The mechanismSHIPPED

Agents read only what's governed.

MCP serving is read-only and audited: agents read, they never write or act. A caller can filter to verified-only, and every citation an agent returns carries its credential: badge, named attestor, date, version, and a link back to the source. Permissions are checked twice (an ACL pre-filter, then a per-item relationship check), so nothing reaches the model that the caller couldn't already see.

read-only audited MCP · two-phase authz · citation credentials

The point of the whole thing

We built the system that makes each of those five impossible.

Not by policy, and not by asking people to be careful. By mechanism. A page with no owner can't hold a badge. A badge can't outlive the bytes it signed. A clock can't overrule a person. An SLA can't be ignored into silence. An agent can't cite what nobody governs. Take away all five moves and the wrong-answer incident has nowhere left to start.

Moffatt v. Air Canada · BC Civil Resolution Tribunal · February 2024

A tribunal held Air Canada liable for a refund policy its own chatbot invented. The airline argued the bot was a separate entity, answerable for its own answers. The tribunal disagreed and ordered the airline to pay. Companies own what their AI says. The only open question is whether anyone owned the knowledge it spoke from.

Proofmark puts a named owner, an attested version, and a review date on the answer itself.

Request access → Open the app →