An AI can find the right document and still act on the wrong fact

A correct citation can still support the wrong decision

Picture a renewal assistant that can see a CRM, an ERP and an account manager’s inbox. The CRM holds last year’s price. The ERP holds the amount on the current invoice. An email discusses a new price that depends on a longer contract. Every one of those records is real and relevant to the renewal, so which amount goes in the offer? This example is illustrative, not a customer case.

A retrieval system can do its job perfectly and return all three, and the model can summarize each one accurately, yet the action can still be wrong. What is missing is a business decision: which agreement governs this renewal, under what conditions, and who can confirm it?

Underneath the agent problem sits a data problem. Giving an agent better access to evidence does not by itself turn that evidence into an authoritative fact.

Relevance, authority and permission answer different questions

A search score tells you which records are useful for a query. An access check tells you whether the caller may read them. Neither says which record governs an action.

Authority has a scope. Finance might own the invoiced amount, while the account manager owns whether a proposed commercial exception was accepted. Time has a scope too, since the date a record was edited can differ from the date a term takes effect. A newer email may hold a suggestion rather than an agreement, and a recently synchronized CRM record can still carry an old value.

So the engineering work goes well beyond picking the freshest chunk. The system has to match entities, tell proposals from commitments, compare like terms and keep the evidence behind each decision. A price that arrives without a currency, a contract period and an effective date is not yet safe to put in a quote.

Keep disagreement visible instead of smoothing it into confidence

When two sources conflict, asking a model for one clean answer can hide the very signal a workflow needs. The system should keep the candidate values and where each came from until a documented rule or a qualified person settles the conflict.

A useful state model separates supported, conflicted, missing and expired facts, and those states should change what happens next. A harmless summary might show both candidates, while a customer-facing quote might stop. Where the line falls depends on what a mistake would cost, and a confident-sounding sentence doesn’t change that.

OWASP’s misinformation guidance recommends cross-verification, human oversight and automatic validation alongside retrieval-augmented generation. The combination is the point: adding sources helps, but checking whether their claims support the intended action is a separate job. [1]

Ask for the missing fact instead of a blanket approval

A reviewer who sees only a polished quote has the same blind spot as the agent, because an approval button does not show the disagreement that vanished upstream. A better question puts the competing evidence on the table: ‘The CRM shows the old annual rate. The email proposes a new rate for a two-year term. Was that term accepted for this renewal?’

The answer should be saved as a reusable, scoped record that carries who answered, the evidence and the time. Without that, the next agent repeats the same research and the next reviewer carries the same burden. Reuse still needs access checks, and the record has to be invalidated when the underlying agreement changes.

The hard part is closing this loop without turning everyone into a full-time data steward. Each question needs an owner, a reason it matters and a limit on how often people are interrupted. If there is no owner or no answer, the gap should stay visible so the agent isn’t invited to guess.

Where Ember is aiming

Ember’s public description centers on this loop: read connected systems, find conflicting or missing facts, ask the person who knows, and keep the answer along with who gave it and when. It describes read-only access and human approval before any source system changes. [2]

None of this replaces search. Search finds the evidence, and a resolution layer decides whether that evidence is enough for a particular decision, then gets the missing answer when it isn’t.

If an agent is going to act for a business, the business needs to be able to say both ‘this is the fact you may use’ and ‘we don’t know yet.’ The second answer is often what prevents the first expensive mistake.

Sources

[1] OWASP: LLM09:2025 Misinformation (opens in a new tab)

[2] Ember: public product description (opens in a new tab)