Output Controls

The output boundary is where generated content leaves the AI system: to a person, to storage, to another agent, to an external service. It is the last place a control can apply, and the only place where the thing being governed was produced by a model rather than retrieved from your data.

That difference drives the design. Content coming out of a model has no inherent provenance, a generated sentence looks the same whether it summarizes a source document or was invented. Output controls exist to make that distinction enforceable.

What this is not

Output governance here is not a second model reviewing the first model's work. That approach inherits every property you were trying to eliminate: it can be persuaded by the same content that persuaded the first model, it is non-deterministic, and it cannot produce an explanation that survives audit.

Lattix output controls are deterministic. The same output, against the same policy and destination, resolves the same way every time. That is what makes the boundary testable before deployment and defensible afterward.

The four control classes

Configure these independently; most deployments use several.

Pattern controls

Deterministic detection of structured sensitive content in generated output: identifiers, credentials, key material, controlled markings, account numbers, and tenant-defined patterns.

Configure per classification tier and per destination. The same pattern may be permitted to an internal reviewer and denied to an external destination.

These are exact and repeatable, which is both their strength and their limit, they find what they are configured to find and nothing else. Treat them as one layer, not the whole boundary.

Provenance controls

The control that addresses hallucination directly, and the one worth configuring first.

Where enabled, an assertion in generated output must be traceable to an authorized source artifact. Configure:

• Which workflows require provenance. Free-form drafting generally does not. Anything that produces a factual claim someone will act on generally should.
• What counts as a citation. A reference to a source artifact identity that was actually in the authorized context for this request, not a plausible-looking reference the model produced.
• Behavior on an unverifiable claim. The options are deny the output, strip the unsupported assertion, or return the output flagged. For regulated workflows, deny.

The important property: an assertion with a broken provenance chain is not a low-confidence output to be passed along with a caveat. It is a denied one. A model cannot satisfy this control by being more confident, because confidence is not what is being checked, the existence of a source is.

This is also why the control works against fabricated citations specifically. A reference is verified against the artifacts actually present in the authorized context, not parsed for plausibility.

Destination controls

Whether an output may reach a given destination, evaluated separately from whether it could be produced.

Configure per destination class from the attribute schema: human-ui, agent, service-api, persistent-storage, external. Common requirements:

• Content derived from a restricted classification may reach a human reviewer but not persistent storage.
• Content may reach an internal agent but not an external API.
• Any output crossing an organizational boundary requires review.

Destination is a policy dimension, not a transport detail. An output that was authorized for display is not thereby authorized for forwarding.

Deterministic transforms

Where an output is neither cleanly allowable nor deniable, transform it. All transforms are repeatable and recorded:

• Redaction and masking of matched content.
• Field deletion for structured output.
• Forced templating, constraining output to an approved structure for regulated workflows. Useful where the risk is not what the model says but how much latitude it has to say it.
• Truncation at a configured boundary.

A transformed output is recorded as transformed, with what was applied. This matters for audit: "the analyst saw a redacted version" is a different fact from "the analyst saw the output," and both need to be recoverable.

Routing

Each output resolves to one of four outcomes:

Configure quarantine deliberately. It is the right outcome where a human decision is appropriate and a hard deny would break a workflow, but a quarantine queue nobody monitors is a deny with extra steps and a false sense of coverage. Assign an owner and an SLA, or configure deny instead.

Ordering

Controls apply in a fixed order, and the order is part of the guarantee:

1. Analysis: pattern, provenance, and structural checks run against the output.
2. Policy evaluation: analysis results combine with principal, purpose, classification, and destination attributes.
3. Routing, the outcome is determined.
4. Transform, applied if the outcome is transform.
5. Delivery, to the authorized destination only.
6. Recording, the outcome, reason, and any transforms are written to the ledger.

Nothing is delivered before step 5, and step 6 is not optional. If the audit path is unavailable, delivery does not proceed, an ungoverned delivery is not preferable to a failed one.

Configuration guidance

Start at the destinations that leave your boundary. External delivery and persistent storage carry the most consequence and the fewest false positives, because the requirements there are usually unambiguous.

Enable provenance requirements per workflow, not globally. A global requirement will be turned off after it blocks the first legitimate drafting task. A requirement scoped to workflows that produce actionable claims will survive.

Test against real output. Pattern controls tuned against synthetic examples behave differently against real model output, which is more verbose and more variable than test data.

Log denials with reasons from the start. The first weeks of denial data tell you whether your controls are calibrated. Denials without legible reasons tell you nothing and generate support load.

Verification

1. An output containing a configured pattern is denied or transformed per policy, and identically on repeat.
2. An output asserting an unsourced claim is handled per your provenance configuration.
3. A fabricated citation to a source not in the authorized context does not satisfy the provenance requirement.
4. The same output to two different destinations resolves differently where policy differs.
5. A transformed output is recorded as transformed, with the transforms applied.
6. A quarantined output is not delivered and appears in the review queue.
7. Every outcome appears in the ledger with principal, destination, and reason.

Related

• Attribute Schema, destination and purpose attributes.
• Retrieval and Context, the authorized context that provenance checks resolve against.
• Audit and Evidence, what output decisions record.
• Immutable Ledger, where those records live.