CaseIntermediateDesigning for Uncertainty & Trust / Trust, transparency and explainability in UX / #10

Explain how source attribution should work in a RAG product.

PICK the product is Docktree, a retrieval tool built by Fenwick Labs that answers on-call questions from runbooks and past incidents

Trestlewood Systems runs cloud infrastructure for other companies. Halden Priest is a senior site reliability engineer there, and he's been on the payments on-call rotation since before Trestlewood adopted Docktree.

The direct answer
Attribute at the sentence level. Every specific claim in a retrieval answer gets its own small citation, naming the document and the date it was last updated, not one combined "Sources" link at the bottom covering the whole answer. The hidden cost of a single end link is that nobody can tell which sentence came from a stale doc when two retrieved sources quietly disagree, and that's exactly the moment attribution exists to catch.
Do this, in order
  1. Attribute per claim, not as one link at the end.Why: it's the only way to know which sentence to trust when two retrieved docs disagree.
  2. Show each source's last-updated date next to its citation, not just its name.Why: a stale runbook step is invisible unless its age sits right there.
  3. Keep single-source, low-stakes answers to one simple end link.Why: not every answer blends sources, and forcing citations everywhere just adds friction for no payoff.
  4. Track citation click-through during real incidents, and revisit the design if it falls near zero.Why: that number is the honest signal that per-claim attribution stopped earning its space.
  5. Never let a merged answer hide which underlying doc a specific instruction came from.Why: that exact gap is what almost caused a real incident here.

How to answer this, stage by stage

Nobody's grading whether you can name every RAG citation pattern. They're grading whether you can commit to one and defend the asymmetry underneath it.

Stage 1
Scope it to one real product
Say it like this
"I'll answer this for Docktree, a retrieval tool that answers on-call engineers' questions from runbooks and incident history."
Why this works
Turns a general RAG-design question into something with real stakes and a real failure mode.
Stage 2
Say your structure out loud
Say it like this
"I'll use PICK. Position, my pick before any reasoning. Impact, who feels each kind of error. Cost asymmetry, which one to optimize against. Kill criteria, what would change my mind."
Why this works
Signals you'll commit to a position instead of listing pros and cons forever.
Stage 3
State the position
Say it like this
"Per-claim attribution, every time. One combined source link at the bottom is cleaner to look at, and it's the wrong call the moment an answer blends two documents of different ages."
Why this works
Answers the actual question in one breath before any evidence, exactly what the direct answer requires.
Stage 4
Name the impact on both sides
Say it like this
"Over-citing costs a reader a few extra seconds skimming past footnotes. Under-citing costs an on-call engineer their ability to tell a current instruction from a deprecated one, mid-incident."
Why this works
Names who feels each error and in what units, not just "one's better."
Stage 5
Prove the asymmetry with a near miss
Say it like this
"Docktree once blended a deprecated 2022 step with a current one into a single, coherent-sounding instruction. One link at the bottom meant nobody could tell which half was outdated. A teammate happened to catch it seconds before Halden acted on it."
Why this works
Shows the hidden cost isn't hypothetical, it nearly landed.
Stage 6
Give the kill criteria and close
Say it like this
"If engineers stop clicking through citations even when a retrieved doc later turns out wrong, that tells me granular attribution isn't earning its space, and I'd simplify back down. Right now the click-through data says the opposite."
Why this works
Shows the pick is a real bet, not a stubborn opinion with no way to be wrong.

Let's learn

Here's the sentence nobody could trace, and why it almost cost a payments team a queue full of in-flight messages.

Docktree reads Trestlewood's runbooks, Confluence pages, and past incident postmortems, and answers an on-call engineer's question directly instead of making them search four tabs.

Knowledge spark: what does "retrieval" mean here? Before Docktree writes an answer, it first pulls a handful of the documents most likely to have the answer, then writes a response using only what those documents say. When it pulls from more than one document, the final answer can quietly blend both together.

Before Docktree, Halden could grep the internal wiki himself and know, in about two minutes, which runbook applied to a given symptom, mostly from memory since he'd read most of them at some point. After Docktree, that same lookup takes about ten seconds, one question typed into a chat box.

Cost, by the numbers: what each attribution mistake actually costs
22 min 11 min 0 Under-cited: 22 min hidden, per bad incident Over-cited: 9 sec visible, per answer read
Note the units: 22 minutes lost to an unnoticed stale doc versus 9 seconds of extra skimming. The two costs aren't remotely the same size.

The turn: the danger was never that Docktree occasionally retrieves a stale document. The danger is that when it does, one combined link at the end gave no way to tell which sentence in the merged answer came from that stale document at all.

The decision I would take back Fenwick Labs shipped one combined "Sources (4)" link at the end of every answer instead of inline citations, since early user testing said inline tags looked cluttered in a chat interface. That made sense while most questions pulled from a single clean doc. It stopped making sense once questions started blending documents of different ages into one paragraph.

What I would leave alone: a question like "who's on call this week," pulled from one live scheduling doc with nothing blended in, is completely fine with a single link at the end. There's no disagreement between sources to guard against when everything came from one place.

The risk was never a wrong document. It was a right-sounding sentence with no way to ask it where it came from.

The lesson: attribution in a retrieval product isn't decoration on top of the answer. It's the thing that tells a person exactly where their trust is allowed to stop and their own judgment has to start.

Hand sketched flow diagram titled Retrieve, merge, attribute. Five boxes: question asked, docs retrieved, merged to answer, cited per claim highlighted, engineer verifies.
The citation step sits between the merge and the trust. Skip it and the merge becomes invisible.

Now here is the same thing as a story

The short version above is what you'd say defending this design in a review. Read this one for the night it actually mattered.

The object in this story is a chat window bolted into Trestlewood's on-call paging tool, the same one Halden has open on his laptop at 3am more nights than he'd like.

Halden's the kind of engineer who reads postmortems for fun. Ask him about a payments-worker queue backing up and he'll usually already know which of three runbooks applies before you finish the sentence.

For the first several months after Docktree launched, it was the best change to his on-call life in years. He'd type a question, get a clean paragraph back, glance at the "Sources (4)" link, and move on. The answers were always right, or right enough, and after a while he stopped clicking that link at all. Why would he. It had never once mattered.

Hand sketched metaphor scene titled The asymmetry, drawn. Left, a document icon labeled Over-cited, caption every line footnoted. Right, a question mark box icon labeled Under-cited, caption one link, whole answer.
One of these costs a reader a few seconds. The other one costs a person their ability to check anything at all.

Then came a 3am page for a payments-worker queue climbing past threshold. Halden asked Docktree what to do. It answered smoothly: check the consumer lag, confirm the dead-letter count, then restart the queue consumer to clear the backlog.

That last step was true in 2022. It was deprecated eight months ago, after the team learned a consumer restart drops in-flight payment messages instead of clearing them. Docktree had pulled from the old runbook and the new one, blended them into a single confident paragraph, and put one link at the bottom covering all four sources equally.

Hand sketched labeled parts diagram titled What is inside one citation. Center document icon labeled Cited sentence, with four callouts: doc name, last updated, confidence, jump to source.
A single end-of-answer link can't carry any of these four things for one specific sentence. Only per-claim attribution can.

Halden's cursor was over the restart button. A teammate on the incident call, half a beat before he clicked it, said, "wait, isn't that the step we killed after the September thing?" That's the whole story. One remembered detail, seconds before it mattered.

With per-claim attribution shipped since, that same blended answer now shows the restart line tagged to the 2022 runbook, dated, next to a second line tagged to the current one, dated three months ago. Halden doesn't need a teammate's memory anymore. He can see the age difference himself, in the same five seconds it used to take to read the sentence.

Hand sketched icon list titled When one link at the end is still fine. Four items: answer pulled from a single doc, source has not changed in months, low stakes non incident question, nothing merged from elsewhere.
Plenty of Docktree's answers still get one simple link. The risk only shows up when sources of different ages get blended together.

I shipped the single link because inline citations tested as "cluttered" in a demo with clean, single-source answers. Nobody in that demo ever asked a question that blended two runbooks of different ages. It took a teammate's memory standing between Halden and a real mistake to see that the demo had never actually tested the failure that mattered.

PICK, in one screenNot a style guide. PICK is what forces you to name the asymmetry instead of listing pros and cons forever.

P
Position. The pick, first.
Attribute per claim, at the sentence level, not one combined link at the end.
States the commitment before any supporting reasoning.
I
Impact. Who feels which error.
Over-citing costs a reader seconds of skimming. Under-citing costs an on-call engineer the ability to tell current from deprecated, mid-incident.
Names both sides in real units, not a vague "tradeoff."
C
Cost asymmetry. The hard step.
Over-citing is visible and cheap: people just skim past it. Under-citing is hidden and expensive: it looks clean right up until the sources disagree.
This is the actual argument. Everything else is setup for it.
K
Kill criteria. What flips it.
If citation click-through drops near zero even on answers that later turn out wrong, the granular design isn't earning its space.
Turns a confident pick into a real, falsifiable bet.
Citation click-through rate during live incidents, weeks after launch
60% 30% 0 2% kill floor Wk1 Wk3 Wk5 Wk7
Click-through settles around 5-6%, well above the 2% kill floor. Trust dropped, but engineers never stopped checking entirely, which is the whole point of a good citation design.

The recap, one line per letter: position is per-claim attribution over a single end link, impact is seconds of skimming against minutes of unnoticed risk, cost asymmetry is optimizing against the hidden one, and kill criteria is the click-through floor that would prove the design wrong.

And if you want to be sure it really works, try it somewhere elseSame four letters, a sales call-notes tool instead of an incident bot. A different industry, and this time the asymmetry runs through a quote instead of a runbook step.

Meridian Notes is an AI meeting-notes product for sales teams. Soraya Bakhtiar runs sales operations at a company that uses it to auto-summarize every customer call.

Mapped onto PICK: position is quote the customer's exact words for anything resembling a commitment, a price, or a date, and paraphrase freely for general sentiment. Impact is a rep who trusts a paraphrased "customer agreed to the renewal price" when the customer actually said "I'd need to check with finance," which shows up months later as a mis-forecasted deal. Cost asymmetry is that exact quotes cost a rep a little extra reading now, visible and cheap, while a wrongly paraphrased commitment costs real forecasted revenue later, hidden until the renewal date arrives and the money doesn't show up. Kill criteria: if reps say the quoted lines clutter their notes and they stop reading summaries at all, fall back to a paraphrase with a confidence flag instead.

Hand sketched quadrant titled Sorting note types by quote need. Axes ambiguity if paraphrased from low to high, stakes if wrong from low to high. Price commitment sits top right, high on both. Renewal date sits near top right. General sentiment sits bottom left, low on both. Feature request sits near the middle.
The top-right corner, high stakes and high ambiguity, is exactly where an exact quote earns its place over a paraphrase.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "cite per claim, not per answer, because the risk lives in disagreement between sources," and stop.
Cost: per-claim attribution adds a few hundred tokens and a bit of latency to every answer. Accept it. Correctness during an incident is worth more than a slightly cheaper, slightly faster response.
The model gets better, for real: even if Docktree's retrieval accuracy improves next quarter, that changes nothing about whether two genuinely current, genuinely correct sources might still disagree in a way only per-claim attribution can show.

Where people run it wrong.
They treat attribution as one design choice for the whole product, when low-stakes and blended-source answers need different treatments.
They add citations everywhere by default and then watch people stop reading them entirely, which is its own kind of failure.
They never define a kill criteria, so a design nobody's checking on quietly becomes permanent regardless of whether it's still earning its cost.

How to use it live. When asked how attribution should work, ask yourself first: what happens the one time two retrieved sources disagree with each other. Design for that moment, not for the average one.

Flashcards (tap any card to flip it)

1 · THE FRAMEWORK
What framework fits "how should source attribution work in a RAG product"?
Tap to flip
ANSWER
PICK: position, impact, cost asymmetry, kill criteria. The cost-asymmetry step is what tells you which citation error to design against.
2 · THE PEOPLE
Who is this answer about?
Tap to flip
ANSWER
Halden Priest, a senior site reliability engineer at Trestlewood Systems, on the payments on-call rotation.
3 · THE HABIT
What did Halden stop doing because Docktree worked?
Tap to flip
ANSWER
He stopped clicking the combined "Sources" link at the end of answers, since it had never once mattered before.
4 · THE ASYMMETRY
Which attribution error does this answer optimize against, and why?
Tap to flip
ANSWER
Under-attribution. It's hidden and costs 22 minutes per bad incident, versus over-attribution's visible 9 seconds of extra reading.
5 · THE OLD DECISION
What decision would you take back?
Tap to flip
ANSWER
Shipping one combined "Sources (4)" link instead of per-claim citations, because inline tags tested as cluttered on single-source demo answers.
6 · THE NUMBER
Fill in the blank: an unnoticed stale source adds about ___ minutes to a real incident, versus 9 seconds of reading friction from over-citing.
Tap to flip
ANSWER
22 minutes. That's the size of the asymmetry PICK's cost step is built to surface.
7 · THE REPLAY
Same blended answer, per-claim attribution shipped. What changes?
Tap to flip
ANSWER
Halden sees the deprecated 2022 step tagged with its date next to the current step's date, and catches it himself in five seconds, no teammate's memory required.
8 · CROSS PRODUCT TRANSFER
Section 4 runs PICK again on a different product. Which one, and what plays the role of the "citation"?
Tap to flip
ANSWER
Meridian Notes, a sales call-notes tool. There, an exact customer quote plays the role a citation plays in Docktree, for anything resembling a commitment.

Check yourself Score: 0 / 0

True or false
1. True or false: this answer recommends citing every single sentence in every Docktree answer, regardless of how many sources were used.
  • True
  • False
Show hint
Careful, look at both the priority list and "what I would leave alone."
Show answer
False. Single-source, low-stakes answers keep a simple end link. Per-claim attribution matters specifically when sources are blended.
Multiple choice
2. Why does this answer optimize against under-attribution instead of over-attribution?
  • A. Because over-attribution is technically impossible to build.
  • B. Because engineers prefer reading more footnotes.
  • C. Because under-attribution is hidden and can cost 22 minutes in a real incident, versus a few seconds of visible reading friction.
  • D. Because Docktree can only support one citation style at a time.
Show hint
Look at the grouped-bar chart, "Cost, by the numbers."
Show answer
C. The asymmetry, not a stylistic preference, is what PICK's cost step is built to find.
Fill in the blank
3. Fill in the blank: the kill criteria for this design is a citation click-through rate near ___ percent during real incidents.
Show hint
Look at the line chart of click-through rate over weeks.
Show answer
2 percent. Click-through actually settled around 5-6 percent, well above that floor, so the design held.
Short answer, name the reversal
4. What old decision does this answer take back, and why did it make sense when it was made?
Show hint
Look at "the decision I would take back."
Show answer
Model answer: Shipping one combined source link instead of per-claim citations, since early testing on clean, single-source demo answers showed people preferred it that way.
Short answer, apply it yourself
5. Pick an AI product you use that cites sources. What's one moment where you'd want to know exactly which sentence came from where, instead of one combined list at the bottom?
Show hint
Think of a time a summary or answer blended two things that later turned out to disagree.
Show answer
Model answer: Most people land on a moment where two retrieved facts contradicted each other and there was no way to tell, from the citation alone, which one to trust.
Before you close the answer
Why this works
Tests whether you can commit to one attribution design and name the real asymmetry underneath it, instead of listing "pros and cons of citations" with no actual pick.
Follow-up traps
"Doesn't per-claim citation just add clutter and slow reading down?" Response: for single-source answers, yes, which is why those stay simple; the cost is worth paying specifically where sources blend and could disagree.

"Couldn't you just always retrieve from the single most recent doc instead?" Response: that was considered and rejected, since the most recent doc doesn't always have the full answer, and forcing single-source retrieval would make answers worse, not just less risky.
If pressed
Docktree's real citation tags are generated from the retrieval step itself, not guessed after the fact by the model, so a citation always points at a document actually in the retrieved set, never a plausible-sounding source invented during generation.
From U2xAI Academy

From answering questions to owning outcomes.

A live workshop where you ship a working AI agent, defend a launch decision, and walk away with a portfolio recruiters can't wave off, not just more questions to study.

  • A live AI agent you actually shipped
  • A launch decision you can defend under pressure
  • An interview-ready portfolio, not more flashcards
Know more