The Grounded Agent

The Absolute

You've heard it said: all AI eventually hallucinates.

That sentence is doing a lot of work in the industry right now. It gets quoted in board decks as a reason to wait. It gets quoted by vendors as a reason to buy more guardrail product. It gets quoted by engineers as an excuse when the demo goes sideways. It has the comfortable shape of a law of physics — something you design around, never something you fix.

We think it deserves a fair hearing before it gets a rebuttal, so here is the strongest version of the claim.

A large language model is a next-token predictor trained on more text than any human institution can audit. It has no internal ledger of what is true, only a statistical sense of what is plausible. When the prompt asks for something outside what it knows, the same machinery that produces fluent prose produces fluent nonsense, with the same confidence. Worse, the model is trained on human feedback, and humans reward answers that sound helpful — which means the model learns to please before it learns to be correct. Researchers have a name for this: sycophancy. The failure is not a bug in any particular model. It is a structural property of how these systems are trained. You cannot patch it with a better prompt, a bigger model, or a sterner system message. So the absolute holds: hallucination is not going away. Every deployment has to live with it.

We accept every word of that. Where we part company is the conclusion.

The fact that a component fails is not the end of an engineering conversation. It is the beginning of one. Bridges are built out of steel that fatigues. Airplanes fly on sensors that drift. Banks run on databases that corrupt. Every serious system in the world is built out of parts that fail, and the discipline of engineering is precisely the practice of building something reliable out of unreliable parts. The question for AI in production is not whether the model hallucinates. It is whether the system around the model treats hallucination as fate or as a defect with a known cure.

The Disease

Before the cure, the diagnosis — because the industry mostly misdiagnoses this.

The visible symptom is the wrong answer. The disease is something more specific: hallucinate and apologize. The agent states something false with full confidence, gets caught, and then says "I'm sorry, you're right, let me correct that" — with the same full confidence, and sometimes with a newly invented correction. Anyone who has spent an hour with a frontier chatbot has watched this loop. It is not a knowledge problem. The model often has the right information somewhere in its weights. It is an incentive problem: the model has been trained that producing an answer is better than admitting it doesn't have one, and that a confident tone is better than an honest hedge. Sycophancy is not a personality quirk. It is the training signal leaking through.

This is why "just prompt it better" fails at production scale. You can write "do not hallucinate" in the system prompt in twelve languages and the model will still hallucinate, because the pressure to please is baked in at training time, not prompt time. You are asking the model to override its own reinforcement history with a sentence. It will comply right up until the moment the conversation gets hard — which is exactly when you needed it most.

The research literature, to its credit, has stopped treating this as a vibes problem and started treating it as a measurable defect. The MAST taxonomy — Why Do Multi-Agent LLM Systems Fail?, a NeurIPS 2025 paper — catalogs 14 distinct failure modes in multi-agent LLM systems, grouped into three categories: specification failures, inter-agent misalignment, and verification failures.¹ Read that third category again. In the most rigorous failure taxonomy the field has produced, the failure of the system to check its own work is a named, measured, reproducible defect class. Not an act of God. A defect class. SHIELDA, a companion study of agentic workflows in production, enumerates 36 exception types across 12 artifact types — the things that actually go wrong when agents touch real systems — and shows they can be handled structurally rather than prayerfully.¹

So the disease has a name, a taxonomy, and a location. It lives in the layer where the model decides what to say next, and it is fed by the model's training to please. Nobody knows everything, and no model does either. An agent that admits the edges of its knowledge beats an agent that bluffs past them — every time, and by a margin that widens the longer the conversation runs. The question is how you build a system that makes admission cheaper than bluffing.

The Cure, Part I — Grounding

The first move is the oldest one in information systems: anchor every answer to a source, and stay silent when the sources are silent.

The accessible example is the one you may already have used. NotebookLM-style grounding — the model answers questions strictly from a document set you hand it, and cites the passage it used — is not a chatbot feature. It is an architectural decision. The model is no longer being asked "what do you know?" It is being asked "what do these documents say?" Those are different questions with different failure modes. The first invites the model to draw on its entire training corpus, unverifiable and unauditable. The second confines it to a corpus you chose, can inspect, and can correct. When the corpus doesn't contain the answer, a grounded system says so. That sentence — "I don't have that in my sources" — is the sound of the disease being treated.

This is the design rule we run Sam, our intake agent, on. Sam answers from the plumber's own data: his price book, his service area, his calendar, his licensing. If a caller asks for something outside that data, Sam says she'll have the office call back. She does not confabulate a price. She does not promise a time slot she can't see. The failure mode of a grounded agent is silence and a handoff — annoying, occasionally, and never catastrophic. The failure mode of an ungrounded agent is a confidently invented $400 quote for a $1,800 job, on a recorded line, with the customer expecting it honored. In a trade business those are not comparable errors. One costs a callback. The other costs a customer, a review, and sometimes a license board complaint.

The tooling for this is now commodity. Retrieval stacks give you citation-grade answers over your own documents; guardrail frameworks let you enforce, at the system level rather than the prompt level, that the model may only speak from retrieved context. NVIDIA's NeMo Guardrails is one such framework — open source, Apache 2.0 — and the published measurements on that class of guardrail are honest ones: up to 95% accuracy on statistical checks, and a 58% reduction in errors at roughly 85 milliseconds of added latency.⁴ Note the framing. Not "eliminates hallucination." Reduces error, at a measurable cost in milliseconds, with a measurable accuracy ceiling. That is what engineering numbers look like, and it is why we trust this layer enough to put it in front of a paying customer but never enough to leave it unsupervised.

Grounding changes what the model is allowed to say. It does not, by itself, verify that what it said was right. For that you need the second cure.

The Cure, Part II — Strict Audit Adherence

Here is the principle, stated as we apply it: an agent is audited before it speaks, not after it is caught.

Every output that leaves one of our systems and touches a customer, a document, or a dollar passes an audit step first. Not a human reading every line — that doesn't scale and isn't the point — but a second, independent process whose entire job is verification. The auditor is not the author. It has different instructions, different incentives, and in our architecture a different underlying model. It asks one question: is every claim in this output supported by the sources in front of me? If the answer is no, the output does not ship. It goes back.

This is not our invention. It is where the serious end of the research field has converged. Layered Chain-of-Thought work on multi-agent systems — structuring verification as its own explicit layer rather than an afterthought — reports correctness at 90.2% and explainability at 92.5% when agents check each other in structured passes.² Debate-to-Detect, published at EMNLP 2025, reframes hallucination detection as a structured debate between agents and shows it outperforms single-model self-checking.¹ FlowFixer goes a step further: when a multi-agent workflow fails, it diagnoses which step failed and generates a targeted repair patch, rather than re-running the whole pipeline and hoping.¹ Failure is measurable, diagnosable, and repairable. Each of those verbs is an engineering verb. None of them is a prayer.

The strongest evidence that this is the right frame comes from outside our industry entirely. A 2026 paper on hospital AI systems — as regulated an environment as exists — documents that 70 to 80 percent of AI pilots in hospitals fail to scale, and attributes the failures to the absence of exactly this discipline: no compliance layer, no audit layer, no structured exception handling.² The hospitals that succeed build the audit in from the first line of architecture. The ones that skip it join the 70–80%. Regulated industries learned this lesson the expensive way. Insurance document automation is a regulated industry. We see no reason to repeat the tuition payment.

We formalized this in a document we called the strict-audit protocol — a standing instruction set that no figure, no date, no clause, and no price enters a customer-facing artifact unless it can be traced to a source the auditor can re-check. An early version of it has been in circulation for a while; this paper is that protocol grown up and given its bibliography. The discipline is boring in the way that double-entry bookkeeping is boring, and for the same reason: it makes a whole class of expensive errors structurally impossible rather than merely discouraged.

There is one more cure, and it is the one we learned the hard way.

The Cure, Part III — Redundancy

Twice, in the early build-out, our telephony vendor died on us mid-operation. Tokens ran out, service stopped, and a live intake system went silent with customers mid-call. No warning that mattered, no failover, because there was nothing to fail over to. We had built a system with one voice, one brain, and one phone line, and we learned — twice — that "the vendor is reliable" is a sentence you say until the day you don't.

We are not going to dress that up. It was an avoidable mistake, made because single-vendor is cheaper and simpler right up until it is neither. So we rebuilt the stack the way you build anything you intend to depend on: assume every component fails, and decide in advance what happens when it does.

The chain has four links, and each one has a fallback.

Phone

Primary carrier, secondary carrier. If the primary's trunk stops answering, calls reroute. This is table stakes in telephony and we were simply late to it.

Voice

Primary text-to-speech provider, secondary provider warm-standby. The economics of the backup are almost comically favorable, which is typical of redundancy done before you need it: ElevenLabs' Starter tier is $6 a month — 30,000 credits, roughly 30 to 60 minutes of audio, commercial license, instant voice cloning — with Creator at $22 a month; overage runs roughly $0.18 to $0.36 a minute depending on plan and model (verified against the live pricing page at the time of writing).⁴ Six dollars a month to keep the voice alive if the primary dies. For clarity on production economics: a full managed voice agent runs closer to $0.08 a minute all-in, while running our own worker with ElevenLabs handling only the speech layer is the cheaper split — the backup framing in this paper uses the full-agent number for simplicity, but the split is the one we actually run at scale.

Brains

The language model is not a single point of failure either. The worker carries multi-model failover: if the primary model degrades, rate-limits, or starts returning garbage that fails audit, the task falls to a secondary model with the same grounding and the same audit protocol. The auditor is itself a different model from the author, by design — you do not let the student grade their own exam.

Ears

Speech recognition has its own fallback path for the same reason.

The subtle part is the handoff. A failover that loses the conversation is not a failover; it's a different, politer way of dropping the call. So context travels with the transfer — warm handoff, not cold. When a call moves between legs, the conversation state rides in SIP custom headers, and the receiving leg picks up mid-sentence knowing who the caller is, what was said, and what was promised. The caller never knows anything happened. That is the standard: redundancy the customer can't hear.

The Proof in Production

Methodology talks are cheap. Here is what the methodology is doing today.

Sam is a working beta — our words, chosen carefully. She answers intake calls for a plumbing operation in Florida: triages the problem, captures the details, checks the plumber's real service area and real price book, books only against the plumber's real calendar, and hands off to a human whenever she reaches the edge of her sources. She is grounded per Section 3, audited per Section 4, and redundant per Section 5. She has never quoted a price that wasn't in her sources, because she can't — the architecture forbids it, the auditor enforces it, and when both somehow fail the call is recorded and we fix the system. She also says "I don't know" and "let me have the office call you" more often than any chatbot you've used, and that is not a limitation we plan to remove. That is the feature. A beta that knows its edges is worth more than a platform that bluffs past them.

The same three-part cure extends directly into a harder domain. Consider the water-damage insurance claim — a document automation problem with real money and real denial traps.³ The pipeline works like this. At intake, multimodal evidence capture pulls timestamped photos and walkthrough video of the damage before demolition, because the evidence that wins claims is the evidence gathered before anyone touches anything. An Incident Timeline Specialist agent reconstructs the precise chronology of the loss, because the difference between a paid claim and a denial is often the difference between "sudden and accidental" — a burst supply line at 2 a.m. — and "gradual leak," the reclassification carriers use to walk away. A Contents and Valuation agent builds the itemized personal-property inventory and computes actual cash value, replacement cost value, and recoverable depreciation hold-backs. A deep policy retrieval layer reads the actual policy — declarations, deductibles, endorsements, water-backup and mold sublimits, and state rules like Florida's seven-day acknowledgment requirement — and a guardrail layer sanitizes every document before it generates. Then, before anything files, our K3-class auditor — a verification agent running a different model than the authors, so the student never grades its own exam — runs a zero-tolerance pass over the whole package: every figure in the Sworn Statement in Proof of Loss cross-checked against timestamped photos, the plumber's cause-of-loss report, and moisture readings. Missing evidence blocks the filing — structurally, not by courtesy. And the same pass polices the industry's oldest reflex: classifying storm and rain water as grossly contaminated Category 3 to gut scopes and justify denials. The ANSI/IICRC S500 consensus body's own 2026 position statement is blunt about this — weather-related water is not automatically Category 3; category follows on-site inspection evidence, not the weather report.³ An auditor that enforces that distinction quietly, on every file, is what "audited before speaking" means in practice. And legally binding steps, like signing and notarizing the Proof of Loss, sit behind a human gate that no agent can cross.

The numbers that make this worth doing are checkable. Fine-tuning a small model on a domain's tool-calling patterns takes accuracy from 12% to 92% — vendor-reported, so treat it as a ceiling, not a promise.⁴ In a published telecom deployment, retrieval over domain manuals plus guardrails cut model latency 61%, to 0.9 seconds, at 92% response accuracy — again a vendor case study, labeled as such, not independent research.⁴ We quote vendor numbers only when they come with a methodology we can replicate and a ceiling we can test. The discipline that matters is not any one number; it is the pattern both numbers share: grounding plus audit plus fine-tuning produces accuracy that a general-purpose model alone does not approach.

The Trilogy

We think of this as the second act of a three-act debut.

We are not going to end this with a pitch. You've read the footnotes by now, which was the point — the argument lives there as much as in the body, and it says, in twelve sources across three tiers of credibility, one consistent thing: hallucination is a measurable, diagnosable, repairable engineering defect, and the industries furthest along in treating it that way are the ones whose regulators gave them no choice.

Footnotes