The model is not the bottleneck. The sign-off is.
The demo goes fine. The stall arrives two weeks later, in a meeting where someone asks where the number came from and the room goes quiet. insightsoftware's June 2026 survey of 114 data and analytics leaders puts figures on it: 51% trust AI-generated insights, 33% worry about hallucinations, 26% have already had a bad outcome from one, and 31% name the inability to verify a result as a barrier to production. Sample of 114, one vendor's survey, so read it as corroboration rather than proof. What it corroborates is that the blocker is evidential, and model quality does not fix an evidential problem.
Ship the citation with the answer, or do not ship
NIST calls this confabulation in the Generative AI Profile it published in July 2024 under the AI Risk Management Framework, and the word is better than hallucination because it describes the mechanism: a fluent, plausible answer assembled without regard for whether the parts are real. The defence is boring and it works. Every figure in an answer carries the query, the table it came from and the timestamp of the data, in the answer itself, where the reader will actually see it. An answer that cannot cite is an answer the assistant should decline to give.
Three tables, not the warehouse
Pick three tables people already trust and can explain, then refuse everything else for a quarter. The instinct is to point the thing at the warehouse, because the warehouse is what you have. An assistant given 400 tables will answer from the wrong one with total confidence, and you will spend the quarter working out which. Narrow scope also makes refusal legible. A flat "I do not have access to that" beats a plausible number pulled from a deprecated table nobody has owned since 2023.
Evaluate against a fixed set of real questions
Write down 50 to 100 questions people have actually asked, with answers agreed by whoever owns the data, and re-run the set on every change. That range is our own practice rather than an industry standard, and the exact number matters far less than the discipline of a set that does not move. Evaluation by impression always reports improvement. A fixed set tells you when a prompt change broke the thing that worked last week, and that is the only signal worth acting on.
Decide what it is allowed to refuse
Refusal is a design decision, and it either happens before launch or it happens during an incident. Decide which questions are out of scope, which data must never surface, and what the assistant says when a question is in scope but the data is missing. OWASP's 2025 LLM Top 10 makes both halves nameable: Improper Output Handling is LLM05, Excessive Agency is LLM06. Worth noticing where the line sits. An assistant that can also act, even if the action is only opening a ticket, has left the chat problem and entered the agent one.
The record is the adoption feature
What turns a pilot into something people keep using is the record, and it has to be more than the transcript. Difinity.ai calls this governed chat: a person asking a model something, run through the same pipeline as every other governed run. The workspace at chat.difinity.ai shows the run in the order it happened, with the model that answered named on the answer. Where a use case is configured to detect personal information, detected values are replaced before the model sees them, and real values are restored only in the last step before an action leaves through the tool gateway. What happened is written to an append-only run trail as it happens. The transcript is the person's own data, the trail is evidence, and neither is derived from the other. One detail worth copying into whatever you build: a reason the model gives for its answer is shown as a claim rather than as a fact, because under a prompt injection that reason was written by an attacker.
A 30-day shape that works
Nothing here needs a platform decision in week one. It needs the people who own the tables to be in the room.
- Week 1: choose the three tables and write the first fifty questions. Get each table's owner in the room, rather than on the email thread.
- Week 2: wire retrieval and make citation compulsory. An answer that cannot show its source does not render at all.
- Week 3: run the question set, fix what it exposes, and write the refusal rules out of the real failures rather than out of imagination.
- Week 4: put it in front of ten real people with the record visible to them, and watch which answers they check by hand. Those are the ones that have not earned trust yet.
- End of month: decide from the question set and the records. Enthusiasm in a channel is not a result.
Frequently asked questions
Why does chat over enterprise data stall after a good demo?
Because a demo answers whether the thing can produce an answer, and production asks whether anyone will act on one. Acting means defending the number to somebody else, which needs the source, the freshness and the reasoning path attached to the answer rather than reconstructed afterwards.
How much data should the first version cover?
Less than feels useful. Three tables with named owners will teach you more in a month than the whole warehouse will, and a narrow scope makes an honest refusal possible instead of a confident answer from a table nobody maintains.
What is the difference between a transcript and a run trail?
The transcript is the conversation, and it belongs to the person who had it. The trail is the evidence of what the system did: the checks, the decisions, the actions, the outcome. Deriving one from the other forces a choice between honouring an erasure request and keeping your evidence.
Does citing sources solve hallucination?
No. It does not stop a model producing a confabulation. It makes one visible at the moment a person reads the answer, which is the difference between a wrong number that gets caught and a wrong number that reaches a board pack.