A retrieval-augmented assistant answers from a corpus, and something has to decide whether the answer it produced is actually supported by what was retrieved. The cheap and obvious check is cosine similarity: embed the answer, embed the retrieved passages, and require the score to clear a threshold.
This is the wrong measurement, and it fails in both directions at once.
What cosine similarity actually measures
The angle between two embeddings is a measure of topical proximity. It tells you that two texts are about the same thing. It does not tell you that one of them follows from the other. Those are different questions with different answers.
A sentence and its own negation are highly similar under any general-purpose embedding model. They share almost every token, the same subject, the same domain vocabulary. If your groundedness check is a similarity threshold, a confident answer that contradicts the documentation scores well.
The reverse fails too. A correct answer that reorganises the source (summarises three passages into one sentence, converts a table into prose, answers "no, that is not supported" when the corpus describes what is supported) can score low against every individual passage while being entirely faithful to all of them.
Two failure directions, one threshold
This is the part that makes the threshold indefensible rather than merely imprecise. The two failures pull the knob in opposite directions:
- False blocks. Safe, correct, well-grounded replies rejected because they paraphrase rather than echo. Raising the threshold makes this worse.
- False passes. Answers the corpus does not support, admitted because they are fluent and on-topic. Lowering the threshold makes this worse.
There is no setting that fixes both, because the score is not measuring the property you care about. Tuning it is choosing which kind of wrong you prefer.
Ask the question you actually mean
The property you want is entailment: does the retrieved context support this claim? That is a judgement about logical relation, not proximity, and a model can be asked it directly: one claim, one set of passages, supported or not supported.
It costs more than a dot product. It is also the only check that can be shown to a compliance reviewer, because it answers the question a reviewer is actually asking. "The embedding score was 0.83" is not an argument that an answer was correct. "Here is the passage that supports this sentence" is.
Making the judge itself accountable
Replacing a threshold with a model moves the problem rather than removing it: now the judge can be wrong. That is what the evaluation harness is for: a replayable suite with versioned baselines, so a change to the judge's prompt or model is a measurable regression rather than a matter of opinion. A guardrail with no eval behind it is a guardrail nobody can defend.
- One real false block: a safe reply the threshold rejected, and why it scored low. Paraphrased, no customer data.
- One real false pass: an unsupported answer that cleared the threshold. This is the example people will remember.
- What the threshold was, and what the observed rates were before and after. Even rough figures make the argument concrete.
- The cost and latency you traded for it. An entailment call per response is not free, and readers will want the number.
- How the judge is evaluated: how many cases, how the baselines are versioned, what a regression looks like.