Fluency is not evidence. Approve an AI-generated answer only when a responsible reviewer can trace each material claim to current, in-scope evidence.
The six-check review
Review each answer in order
Break the answer into claims
A sentence may contain several facts: algorithm, scope, cadence, owner, or exception. The citation must support each material part.
Read the source around the cited passage
Check headings, definitions, exceptions, and dates. A matching sentence can still be misleading when taken out of context.
Compare the requested and proven scope
Watch for words such as all, always, never, annually, production, customers, and subprocessors. These terms often widen a claim beyond the evidence.
Search for conflicting approved evidence
Do not let the system silently pick a favorable source. Conflict belongs with a human owner.
Choose a review state
Use Supported only when the whole answer passes. Use Needs review for partial support or conflict, and Unknown when no trusted source answers it.
Record who approved it
Keep the reviewer, date, source version, and any qualification with the answer.
A redacted synthetic example
Fictional encryption answer
Question: Is all customer data encrypted at rest with AES-256?
AI draft: “Yes. All customer data and backups are encrypted with AES-256.”
Source: “Production databases use AES-256 encryption at rest.”
Needs review The source supports production databases, but not all storage or backups. A safe revision is: “Production databases use AES-256 encryption at rest. Backup and object-storage coverage requires confirmation.”
Common mistakes
- Checking whether a source is related instead of whether it proves the claim.
- Trusting confidence scores as approval.
- Ignoring qualifiers in the question.
- Reviewing answers without seeing the source passage.
- Approving a batch when one control owner has not reviewed their domain.
How SaneCite handles this
SaneCite shows the source behind supported answers and runs a separate check on whether the evidence supports the draft. Answers without enough support stay visible as review items. The human reviewer still owns approval.
Questions people ask
- Is a citation enough?
- No. The citation must support the full claim, fit the requested scope, and remain current.
- Should every answer get human review?
- Yes before submission. Risk-based triage can focus attention, but the accountable organization still owns every claim sent to the buyer.
- What is the difference between needs review and unknown?
- Needs review means some evidence or a conflict exists. Unknown means the approved evidence set does not answer the question.
Primary sources
- NIST AI Risk Management Framework (accessed July 26, 2026).
- NIST AI 600-1, Generative AI Profile (accessed July 26, 2026).
- NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls (accessed July 26, 2026).
Published July 26, 2026. No material revisions yet.
Review the source beside the answer.
See cited drafts and uncovered questions in one review flow.