How Do AI Citations Work? (And Two Ways a Sources Line Can Mislead)

From the AnswerRails development blog — plain-English explanations of the technology behind trustworthy AI chat.

In the first post in this series we described the open-book exam: instead of letting an AI answer your visitors’ questions from memory, you hand it the relevant pages of your own website and ask it to answer from those. That post ended with a promise to explain the next piece of the puzzle — how do you know the AI actually read the book? The answer, when it works, is the little line at the bottom of a reply that says Sources.

This week that line has been on our workbench, because we caught it doing something subtly wrong. So this post is about what a citation actually is, why it matters more than it looks, and two real ways a Sources line can mislead — both of which we found in our own product, in our own chat logs.

What a citation actually is

When a visitor asks a public-facing AI assistant a question, three things happen in quick succession. A search runs over the site’s own documents and fetches a couple of dozen excerpts that look relevant. The AI writes an answer, drawing — if all is well — on a handful of those excerpts. And then, underneath the answer, the assistant lists the documents it drew on, each one a link to a real page.

That list is the citation. And a citation is best understood as a promise: this answer stands on that page — go and look.

Which is why citations matter more than their modest appearance suggests. A chatbot without sources asks to be taken on trust. A chatbot with sources can be checked — by the visitor, who can click through and read the page for themselves, and just as importantly by you, the site owner, reading your chat logs over coffee the next morning. Our working rule for the whole product is never take the AI’s word for anything you can check, and a Sources line is what makes an answer checkable at all.

But a promise is only worth something if it’s kept. Here are two ways we’ve watched it break.

The greeting that arrived with sources

Early in development, a visitor to our demo shop typed one word: “Hello.”

The assistant replied, perfectly reasonably, “Hello! How can I help you today?” And underneath that greeting, it printed: Sources: Hello world!, Clan Name Relationships.

It had cited the default WordPress post — the “Hello world!” page every new site starts with — as a source for saying hello.

The explanation is almost funny once you see it. The document search runs before every message, because at that point nothing knows whether the message is a question or a pleasantry. Asked to find pages resembling “Hello”, it dutifully returned the closest matches it had, and the AI just as dutifully listed them. Every one of those documents was real. The search genuinely fetched them. And the Sources line was still false — because the promise a citation makes is this answer is based on these pages, and the answer was based on nothing at all.

That’s the first lesson about citations: a Sources line can be built entirely from real documents and still be a false statement. The fix, once we understood the problem, was plain: small-talk replies now cite nothing, and our quality scoring stopped awarding marks for citations an answer never used. An empty Sources line under “Hello! How can I help?” is the honest one.

Twelve sources for one clan

The second failure is this week’s, and it’s the opposite of the first: not sources that were never used, but too many of them.

Part of every release for us is firing a battery of test questions at the live demo shop and reading the results back through the chat logs. One of this week’s questions was about Clan Cameron — crest, septs, the usual. The answer was good: grounded in the site’s own pages, correct, every link real and working.

But the Sources line listed twelve documents. And on the follow-up question it listed nine — nine clan-map pages, not one of them about Cameron.

Nothing was invented. Every page existed; every link loaded. What the assistant had done was list a large slice of everything the search fetched, rather than the two or three pages the answer actually stood on. And a citation list like that quietly breaks the promise from the other direction: a visitor who wants to check the answer now has to wade through a dozen links to find the one that matters. Cite everything and you may as well cite nothing — the reader can no longer tell which source is load-bearing.

So we did what we always do with a finding like this: logged the evidence, filed the issue, and designed the fix before touching code. The Sources line should list what the answer used, not what the search returned, and it should be capped at a sensible handful. In the interests of honesty — because honest engineering stories are rather the point of this series — that fix is filed and designed but not yet shipped. If you’re watching our demo, you should see the Sources lines get shorter in a coming release.

And the links must exist

There’s a third way a citation can fail, the bluntest of the three: the AI can simply invent a source — a plausible-looking link to a page that has never existed. We told that story in our guardrails post, where our assistant confidently invented two products, complete with convincing web addresses, on our own domain.

That one we treat as a hard stop. Before any answer reaches a visitor, every link in it is checked against the site’s real pages, and an invented link fails the whole answer rather than being quietly served. In this week’s release checks — umpteen scenario conversations fired at the live site — that check had a quiet day: not one invented link, and every single cited page loaded when we clicked it. Quiet days are what good guardrails sound like.

Three questions worth asking

If you’re evaluating an AI assistant for the front of your own website — ours or anyone’s — the citations behaviour is worth probing, and three questions get to the heart of it:

Does the Sources line show what the answer used, or what the search returned? (Asked of AnswerRails today, the honest answer is “the search, for now” — which is exactly why it’s on our fix list.)

Are cited links checked to actually exist before the visitor sees them? An AI that can print an invented link under the word “Sources” has turned the trust signal into a liability.

Can you, the owner, see the difference in your logs? Our chat logs record what the search offered and what the reply cited, separately — so when a Sources line misbehaves, there’s evidence to read rather than a mystery to shrug at.

A citation is a promise you can check. The engineering job — never quite finished — is making sure it’s a promise that’s kept: no sources the answer never used, no more than the answer needs, and never, ever a link to a page that doesn’t exist.

Next in this series: why your AI should tell you when it’s having a bad day — the story of our assistant’s health dashboard, and the afternoon a provider slowdown taught us what an assistant should say about itself.

---

AnswerRails is a public-facing AI assistant for WordPress, in development at Celtic3d — built compliance-first, with guardrails as the product rather than an afterthought. Follow its progress at answerrails.com.