AI Capabilities: Done Right

Ross holds a full client record: name, date of birth, the injury, the treatment history, how long the matter has run. When a model drafts a message that client will read, it receives the client's first name, the document's file name, and the text of the document. Nothing else.

That trade is acceptable in most products and it is not acceptable here. A summarizer that knows a client is frightened writes a calmer summary than the record supports. In a legal matter that is not a quality regression. It is a false statement about a case, sent under an attorney's name.

So the restriction is enforced at the point the prompt is assembled, and a test locks the exact shape of it. The test asserts three parts and no fourth: first name, document label, document text. It also asserts that the surname does not survive, that the middle name does not survive, and that seven specific profile words never appear in the prompt in any framing.

If someone adds a field, that test fails. It fails even when the new field looks harmless, which is the point, because the dangerous fields all look harmless when you read them as strings.

What Ross will not doThe feature here is defined by what was refused. Ross could write warmer, better-reading client messages tomorrow by passing the model everything it already knows. It does not, because the research says the same change makes them less true.

When a document arrives, a deterministic scan decides whether it is safe to tell the client about, or whether it has to go to an attorney. A model reads the same document separately. The model's findings can move a document up to attorney review. Nothing the model says can move a document down.

It was derived from watching an early version escalate real court documents for reasons that were confidently and checkably wrong, on documents an attorney could read themselves in ten seconds.

That is the failure that ends the relationship. A reviewer who catches the system being wrong about a document they can read stops trusting it about the three hundred pages they cannot. So the rules were rewritten to match what a sentence means rather than which words it contains, and the model was placed where its worst realistic failure costs nothing.

The worst realistic failure of a language model here is a confident, articulate, well-written "this one is fine." Wired this way, that output is worth exactly zero. If the deterministic scan says a document needs an attorney and the model says it is routine, it goes to the attorney. A finding the system cannot parse also goes to the attorney: unreadable defaults to escalate, not to safe.

What Ross will not doThe model is the least trusted component in the system and it is wired that way on purpose. It gets to add caution. It never gets to remove it.

The gate, measured on this build →

Before a summary can be shown, every factual claim in it is checked against the source document. A model decomposes the summary into atomic claims and must quote the exact sentence supporting each one. Then code checks that the quoted sentence is really in the document. Then code checks the money.

The second layer asks one question: is this quoted sentence in the document? It never asks whether the sentence says what the claim says. A claim of $310,000, attached to a real sentence reading "three hundred one thousand dollars," passed both layers and came back marked fully supported. That was measured against this system, not theorized about.

Summaries are rarely invented out of nothing. They are a real figure off by a digit, cited to a real sentence. That is the version that reaches a client. So a third layer checks whether an amount asserted in a claim appears in the document at all.

It checks money and only money. Dates and counts are not covered, and that gap is measured rather than assumed. A date written two different ways differs in format before it differs in fact, and a check that fires on formatting is one a firm learns to click past within a week. A warning everyone dismisses protects nobody.

The check never returns a pass it did not earn. No model configured, an error, a blocked transmission, or nothing extractable all return "not checked." The review screen shows "not checked." It never shows a green light it did not verify.

What Ross will not doThe 98.3 and 81.7 are CiteCheck's numbers on CiteCheck's benchmark of scientific citations, and they are printed here to explain why the third layer exists. They are not a measurement of Ross. The failure shape transfers; the score does not.

How the grounding check is built →

A model has a budget for how much text you can hand it at once. For a long time every safety check inherited that budget, and read roughly the first four pages of whatever arrived. A three-hundred-page medical production was judged on page four.

The budget is a constraint on the model. The safety checks are not a model. They are pattern matching, they cost effectively nothing, and they can run across four hundred pages as easily as across four.

An examination order that a client is required to attend is as likely to sit on page two hundred and twelve as on page two. In the case that prompted the fix, the order was on page forty of a production, the document was read to page four, found routine, and drafted into a reassuring client message. Every safety rule in the system worked correctly. None of them ever saw the sentence that mattered.

Now every page is scanned on its own, which is what lets the attorney's queue say which page the problem is on instead of saying "somewhere in here." The full text is then scanned again joined together, because a sentence can straddle a page break and per-page scanning alone would miss it. The more severe of the two results wins.

What Ross will not doA safety check that reads only the beginning of a document is not a safety check. It is a safety check's screenshot.