A citation that only works while you're logged in isn't traceability

Trovato has had a hard rule since the first commit: every AI-generated output must resolve to a citation anchor on a raw source document, or it does not render. Not a footnote-shaped decoration — an anchor that opens the actual page, with the actual passage highlighted.

We were pleased with it. Then a pilot user exported a draft to Word, opened it, and found a document carrying bare markers — a "[1]" pointing at nothing at all.

Where the chain actually breaks

Inside the product the chain is complete. Outside it, the exported file is just a file. And the exported file is the artifact that matters most: it is the one that goes to the client, to the counterparty, and occasionally to a regulator. Every recipient of it was outside the only place the citations worked.

The uncomfortable way to put it, which is the way we ended up writing it down: a citation that only works while you are logged in is not traceability, it is a UI affordance.

Real footnotes, and three things we turned down

Exported drafts now carry genuine Word footnotes. Not endnotes — a lawyer marking up clause 9 should not have to page to the back. Not a bibliography — that records what was consulted, when the point is to bind this sentence to that clause. And not a link back into Trovato, because a link is a dependency on the system, and the requirement was that the citation survive leaving it.

A footnote reads: Project Atlas SPA (executed).docx, cl. 9.3, p. 42. It is legible to someone who has never heard of us, which is the entire point. We also left out the internal anchor identifier: a raw identifier in a client-facing document is noise, and it solves a problem nobody has yet.

One switch, because the footnote names your files

Here is the wrinkle we did not see coming. Project Atlas SPA (executed).docx in the footnote of a clean draft sent to the other side discloses the existence, the naming convention and the executed status of a document nobody agreed to disclose. The mechanism that gives you traceability inside the firm is a disclosure risk outside it, and the export route cannot tell which is which.

So footnotes are on by default and there is one checkbox to turn them off, decided per export rather than set once by an administrator. The person clicking Export is the only one who knows where the file is going, and they know it at that moment.

And one thing that stayed broken on purpose

Our invariant says an output with no resolvable source is dropped. Applied literally to an export, that would delete a lawyer's sentences because an anchor went stale — which is a far worse failure than a visible marker. So exports drop the footnote and never the text, and the count of unresolved anchors is written to the audit row so the silence is at least observable.

Rules that are right for synthesis are not automatically right for a person's own work product. That distinction cost us an afternoon of argument and is, we think, the most useful thing in the whole change.