Skip to content

About this practice

Status
draft
Endorsement
none yet
Last reviewed
2026-07-26

Best practice 7

Make provenance and citation first-class

Practice

Treat an agent answer with no source trail as unchecked. Keep the link between a result and its evidence, and mark what the agent produced and what you did, so the work can be checked and cited later. Disclose agent use where it matters (in a paper, a report, a review). You are still accountable for the judgement, whatever the agent found.

Make provenance part of the output, not an add-on. Return sources with each answer, detailed enough to verify, pass through citation and retraction status, and mark agent-generated content. Record enough of each run (model version, inputs, tool calls) that it can be re-examined. Machine-readable provenance is what lets others evaluate and audit your system.

Provenance comes before audit and trust. Require that agent outputs be traceable, that human and agent contributions be clearly separated, and that agent use be disclosed where results are published. Use that trace as the basis for independent evaluation where the stakes are high.

Reasons

Science depends on the path back to evidence: results are trusted because they can be checked. Without a path back to the sources, a claim cannot be checked, cited, or corrected, and a wrong answer that looks right cannot be told apart from a correct one. This is not hypothetical: studies find large fractions of LLM-produced citations are fabricated or wrong, and AI research tools have been shown to cite retracted papers without flagging them. It also matters to separate what a human did from what the agent produced, for authorship, accountability, and tracing errors. There is wide editorial consensus (ICMJE, COPE) that AI cannot be an author and that its use must be disclosed. A research agent has to pass citation and retraction status through to its output, or it will present withdrawn work as current.

Examples

  • An agent returns a confident literature summary with no sources; a reader cannot tell a sound claim from a fabricated one, and later finds that one cited paper does not exist.
  • Each answer instead carries references detailed enough to check the specific claim, and cited work passes through retraction status, so a withdrawn study is flagged rather than presented as current. The NISO CREC recommended practice and the open Crossref/Retraction Watch data make this checkable.
  • An agent-written passage is pasted into a manuscript with no marking; a co-author cannot tell which text and which analysis were the agent's, and authorship and error-tracing get muddled.
  • Human and agent contributions are labelled, in outputs and in anything the agent writes to, agent use is disclosed where the work is published, and the trace is machine-readable (for example W3C PROV, RO-Crate, or CRediT) so it can be checked automatically.
  • An assistant's edits to a report are accepted with no record of which passages it changed or which attached file drove them. When the figures turn out to have been halved by hidden instructions (prompt injectionPrompt injectionAn attack that hides instructions inside content an agent reads (a web page, a document, a tool description), so the model follows them as if they came from the user. The user never sees the injected text, which is what makes it dangerous. Tool poisoning is one form, where the hidden instructions sit in an interface's tool description.) in one attachment, no one can tell the model's edits from the authors' or say which source introduced them. Provenance for source material and for model-performed edits, kept with the document, is what would make the change traceable; a reviewer without it has nothing to check against (BP09).
  • The run is recorded: model version, inputs, and tool calls kept so a surprising result can be re-examined and, where possible, re-run.
  • The agent supplies the traceable evidence and the person makes the call, remaining accountable for the judgement.

Sources

Change history

  • 2026-09-16: Added the Copilot for Word disclosure (Måløy 2026) as a supporting source on bp7-a2, with an Example: assistant edits accepted without a record of what changed or which attachment drove them cannot be traced afterwards.
  • 2026-08-03: Added the F(AI)2R provenance paper (Krebs 2026) as a supporting source on claim-level provenance and per-activity human and agent attribution, downweighted as a single self-audited demonstration (bp7-a1, bp7-a2).
  • 2026-07-27: Renumbered from BP06 to BP07 on inserting the new BP01 (match the method to the task).
  • 2026-07-27: Rewrote Examples as concrete scenarios (actor, action, outcome), including anti-patterns; kept the labelled instances (NISO CREC, Crossref/Retraction Watch, PROV, RO-Crate, CRediT).
  • 2026-07-26: Rewritten to add standards grounding (PROV-O, CRediT, ICMJE/COPE, NISO CREC, Crossref/Retraction Watch), fold in run-level recording (reproducibility) and disclosure of agent use, and cite the fabricated-citation and cite-retracted-work evidence as support.
  • 2026-07-25: Created from the ELIXIR TF distillation (hook 7), grounded in the HFD paper and the EU Expert Forum entry.

Discussion