Every figure, checked against its source

What the guardrail is

Every AI drafted answer headed for the other side is verified against the documents it quotes before anyone sees it. The model does not get to speak freely to a counterparty: it emits a structured draft through a forced tool call, and the server checks that draft before rendering a character.

Three gates run on every citation:

• Permission. The cited document must resolve to one inside the permitted set for that answer. Anything else is dropped.
• Faithfulness. The quoted passage must be present in that document's stored text as a whitespace normalised substring, with an alphanumeric only fallback for PDF and spreadsheet extraction artefacts.
• Anchor. The phrase the citation attaches to must actually appear in the answer.

If an affirmative answer survives with zero citations, the text is replaced with a manual review note and downgraded to partial. The unsupported version never renders.

What it catches on a live deal

The draft states a money figure that none of its quotes support. Then what?

Your reviewer sees it flagged. The surviving draft is scanned for money figures present in the answer but absent from every verified quote. Format is normalised, so $45.2M, 45.20 and 45.2 million count as one amount.

Does a flag block the send?

No. Flags go to the reviewer, never to the counterparty. The same scan raises MNPI risk (reserve or walk away price, competing bid, "bidder X") and negation polarity flips, where a draft reverses the sense of the passage it cites.

How long does checking one take?

One click. Each verified quote becomes a link that opens the source document with that quote as the highlight target.

Which documents the AI may quote

For a counterparty facing draft, the document set is scoped to what that side is permitted to read, not to what your deal team sees.

• One retrieval path. Every AI feature that reads deal documents goes through the same function: it embeds the query, cosine scores the stored vectors, then applies the folder read check before a document is admitted, ahead of ranking. No laxer path for drafting than for chat.
• Intersection, not union. Where more than one counterparty organisation can see the same request list, a folder is admitted only if every one of them may read it.
• Fail closed. Ambiguity denies. A decrypt failure on the list denies, and org level checks ignore per user overrides so one cannot widen the org baseline.
• Separate rooms. Retrieval runs against that deal's own database file, served from its own subdomain. Cross deal leakage is structural, not policy.

Where it stops

There is no reconciliation engine. Nothing extracts figures into a structured set, normalises periods, or records a discrepancy with an owner and a status. The check compares an answer against its own cited sources, not document A against document B.

Data room chat handles conflict by prompt: when retrieved documents disagree, the model is told to give each figure separately with a titled link and its source date. That fires only when both documents land in the same retrieval batch.

Other limits that bear on numeric work:

• Top K retrieval. A conflict between two documents that are not both retrieved will not surface.
• One vector per document, built from truncated text. A figure buried deep in a long file may not be what drives retrieval.
• Best effort enrichment. A file whose processing fails is stored and viewable but carries no embedding, which keeps it out of chat and search. Your team can re-run enrichment across the room.
• No OCR. Scanned PDFs with no extractable text are the weakest case.
• Read tiers. Retrieval admits any folder the reader is not blocked from, including view only and watermarked, so an answer can quote a document the reader may read but not download.

Injection defence is prompt level. What holds is mechanical: the per deal database file plus the checks above.

What you still do with a difference

Judgment, in this order.

1. Confirm the two figures are meant to be the same figure. Metric definition, entity and consolidation scope, period, basis, currency. Many apparent conflicts end here.

2. Decide which source governs. An audited statement, a management pack and a signed contract carry different weight.

3. Find the explanation. Restatements, reclassifications, add-backs and timing cut-offs are usually documented in the same room.

4. Decide the consequence. Update the model, raise a request to the other side, adjust a representation, or record the item as immaterial.

5. Record the decision. A backlog scan flags a new request duplicating one in flight; once your team approves the match, the earlier request's confirmed answer documents attach to the new one. Buyers can dispute a merge.

If you need assurance that every number in the room ties, that is tie out work and people still do it. More on features and security.