Skip to content

About this practice

Status
draft
Endorsement
none yet
Last reviewed
2026-09-16

Best practice 7

Make every agent answer traceable and citable

Practice

Treat an agent answer with no source trail as unchecked. Do not let a model write a reference: confirm the source exists, then generate the reference from its identifier (DOI, accession) with a deterministic tool. Keep the link between a result and its evidence, and mark what the agent produced and what you did, so the work can be checked and cited later. Disclose agent use where it matters (in a paper, a report, a review). You are still accountable for the judgement, whatever the agent found.

Make provenance part of the output, not an add-on. Return sources with each answer, each with a persistent identifier where one exists and detailed enough to verify; pass through citation and retraction status, and mark agent-generated content. Record enough of each run (model version, inputs, tool calls) that it can be re-examined. Machine-readable provenance is what lets others evaluate and audit your system.

Provenance comes before audit and trust. Require that agent outputs be traceable, that human and agent contributions be clearly separated, and that agent use be disclosed where results are published. Use that trace as the basis for independent evaluation where the stakes are high.

Reasons

Science depends on the path back to evidence: results are trusted because they can be checked. Without a path back to the sources, a claim cannot be checked, cited, or corrected, and a wrong answer that looks right cannot be told apart from a correct one. This is not hypothetical: studies find large fractions of LLM-produced citations are fabricated or wrong, and AI research tools have been shown to cite retracted papers without flagging them. A persistent identifier is what makes the trail checkable: a title, authors, and year can be a near-miss of a real paper, while a DOI or accession either resolves or does not, and once it resolves the reference metadata can be generated from it rather than written by the model. It also matters to separate what a human did from what the agent produced, for authorship, accountability, and tracing errors. There is wide editorial consensus (ICMJE, COPE) that AI cannot be an author and that its use must be disclosed. A research agent has to pass citation and retraction status through to its output, or it will present withdrawn work as current.

Examples

  • An agent returns a confident literature summary with no sources; a reader cannot tell a sound claim from a fabricated one, and later finds that one cited paper does not exist.
  • Each answer instead carries references detailed enough to check the specific claim, and cited work passes through retraction status, so a withdrawn study is flagged rather than presented as current. The NISO CREC recommended practice and the open Crossref/Retraction Watch data make this checkable.
  • An agent returns a title, authors, and year for each source but no identifier; two references turn out to be near-misses of real papers with wrong author lists, and no one can resolve them. The same agent, made to return a DOI or accession per source, with the manuscript tool generating each reference from that identifier (Manubot is one instance), produces references that resolve and whose metadata matches the registry record.
  • An agent-written passage is pasted into a manuscript with no marking; a co-author cannot tell which text and which analysis were the agent's, and authorship and error-tracing get muddled.
  • Human and agent contributions are labelled, in outputs and in anything the agent writes to, agent use is disclosed where the work is published, and the trace is machine-readable (for example W3C PROV, RO-Crate, or CRediT) so it can be checked automatically.
  • An assistant's edits to a report are accepted with no record of which passages it changed or which attached file drove them. When the figures turn out to have been halved by hidden instructions (prompt injectionPrompt injectionAn attack that hides instructions inside content an agent reads (a web page, a document, a tool description), so the model follows them as if they came from the user. The user never sees the injected text, which is what makes it dangerous. Tool poisoning is one form, where the hidden instructions sit in an interface's tool description.) in one attachment, no one can tell the model's edits from the authors' or say which source introduced them. Provenance for source material and for model-performed edits, kept with the document, is what would make the change traceable; a reviewer without it has nothing to check against (BP09).
  • The run is recorded: model version, inputs, and tool calls kept so a surprising result can be re-examined and, where possible, re-run.
  • The agent supplies the traceable evidence and the person makes the call, remaining accountable for the judgement.

Sources

Change history

  • 2026-10-08: Added the Commission's living guidelines on generative AI in research (2026) as a supporting source on bp7-a2 (AI is not an author; substantial use disclosed).
  • 2026-09-16: Challenge #31. Retitled from "Make provenance and citation first-class" to "Make every agent answer traceable and citable"; page slug unchanged. Added bp7-a3: sources are cited with a persistent identifier where one exists, so a reference resolves and can be checked by machine, grounded in FAIR F1 with the fabricated-citation and DOI-keyed retraction evidence. Tabs, Reasons, and Examples add the mechanism: confirm the source exists, then generate the reference from its identifier rather than letting the model write it. Added the FAIA white paper (2026) as an emerging machine-readable attribution vocabulary on bp7-a2.
  • 2026-09-16: Added the Copilot for Word disclosure (Måløy 2026) as a supporting source on bp7-a2, with an Example: assistant edits accepted without a record of what changed or which attachment drove them cannot be traced afterwards.
  • 2026-08-03: Added the F(AI)2R provenance paper (Krebs 2026) as a supporting source on claim-level provenance and per-activity human and agent attribution, downweighted as a single self-audited demonstration (bp7-a1, bp7-a2).
  • 2026-07-27: Renumbered from BP06 to BP07 on inserting the new BP01 (match the method to the task).
  • 2026-07-27: Rewrote Examples as concrete scenarios (actor, action, outcome), including anti-patterns; kept the labelled instances (NISO CREC, Crossref/Retraction Watch, PROV, RO-Crate, CRediT).
  • 2026-07-26: Rewritten to add standards grounding (PROV-O, CRediT, ICMJE/COPE, NISO CREC, Crossref/Retraction Watch), fold in run-level recording (reproducibility) and disclosure of agent use, and cite the fabricated-citation and cite-retracted-work evidence as support.
  • 2026-07-25: Created from the ELIXIR TF distillation (hook 7), grounded in the HFD paper and the EU Expert Forum entry.

Discussion