SOX retrieval architecture with citation integrity for enterprise LLM deployment — Reference Architecture

Reference architecture · published 2026-10-16 · regulated enterprise · SOX · layout spec_first · implementation executed in CI before publish

Technical parameters

Every value below is a parameter you can hold a vendor or an internal team to. Adjectives are not acceptance criteria.

The control that resolves this is a Query-Time ACL Retrieval with Citation Integrity, evaluated before the request reaches a model provider rather than audited afterwards. In regulated enterprise the binding constraint is SOX, and the question it actually asks is can an AI-influenced number in a filing be traced and reproduced. The shape below holds p95 ≤ 600ms over REST over HTTPS, and ships with a standard-library implementation that runs as written.

The control gap

Permissions were applied when documents were indexed, the index is refreshed nightly, and citations are whatever the model names. So a revoked user still gets content, a superseded policy is quoted as current, and a citation points at a document that does not contain the claim.

What SOX specifically requires

SOX cares about the integrity of financial reporting. If a model output touches a number that reaches a filing, the control question is whether that output can be reproduced exactly and attributed to a reviewed, approved version.

The artifact that satisfies it is reproducible output records pinned to a model version. The way teams most often fail it: a model upgrade changing a reported figure with no record of which version produced the original.

Working implementation — Query-time ACL retrieval with citation containment

Standard-library Python, no external dependencies, runs as written. Executed by the publish gate: if it raises, this page does not ship. Wire it behind REST over HTTPS; the failure mode it guards against is a retried POST creating a duplicate record. The output you hand the assessor is the reporting-period reproducibility record.

"""Retrieval with query-time ACLs, freshness SLO and citation integrity.

Three failures, one surface. Permissions applied at INDEX time go stale the
moment access changes, so a revoked user keeps seeing content through the
model. A stale index answers confidently from a superseded document. And a
citation that does not actually contain the claim is worse than no citation,
because it manufactures confidence.
"""
from dataclasses import dataclass, field


@dataclass
class Doc:
    doc_id: str
    text: str
    version: int
    indexed_at: int
    acl: set = field(default_factory=set)
    superseded_by: str | None = None


class Index:
    def __init__(self, freshness_sue_s: int = 3600):
        self.docs: dict[str, Doc] = {}
        self.freshness_sue_s = freshness_sue_s

    def put(self, doc: Doc) -> None:
        self.docs[doc.doc_id] = doc

    def stale(self, now: int) -> list[str]:
        return sorted(d.doc_id for d in self.docs.values()
                      if now - d.indexed_at > self.freshness_sue_s)

    def search(self, term: str, user_acl: set, now: int) -> list[dict]:
        """ACL is applied HERE, at query time, against live entitlements —
        not baked into the index where it goes stale on the first revocation."""
        hits = []
        for d in self.docs.values():
            if term.lower() not in d.text.lower():
                continue
            if d.superseded_by:
                continue
            if d.acl and not (d.acl & user_acl):
                continue
            hits.append({"doc_id": d.doc_id, "version": d.version,
                         "text": d.text,
                         "stale": now - d.indexed_at > self.freshness_sue_s})
        return sorted(hits, key=lambda h: h["doc_id"])


def verify_citations(answer: str, citations: list, index: Index) -> dict:
    """A citation must contain a claim-bearing span of the answer. This is a
    containment check, not a similarity score — a loose threshold here is how
    plausible-but-unsupported citations get through."""
    supported, unsupported = [], []
    sentences = [s.strip() for s in answer.split(".") if s.strip()]
    for cite in citations:
        doc = index.docs.get(cite)
        if not doc:
            unsupported.append({"cite": cite, "reason": "cited doc not in index"})
            continue
        if any(s.lower() in doc.text.lower() for s in sentences):
            supported.append(cite)
        else:
            unsupported.append({"cite": cite,
                                "reason": "no cited span appears in the document"})
    return {"supported": supported, "unsupported": unsupported,
            "trustworthy": not unsupported}


if __name__ == "__main__":
    idx = Index(freshness_sue_s=3600)
    idx.put(Doc("d1", "Refunds are processed within 14 days", 7,
                indexed_at=0, acl={"finance"}))
    idx.put(Doc("d2", "Refunds are processed within 30 days", 3,
                indexed_at=0, acl={"finance"}, superseded_by="d1"))
    idx.put(Doc("d3", "Public holiday schedule", 1, indexed_at=0))

    # Entitlement is checked at query time.
    allowed = idx.search("refunds", user_acl={"finance"}, now=10)
    assert [h["doc_id"] for h in allowed] == ["d1"], allowed
    denied = idx.search("refunds", user_acl={"marketing"}, now=10)
    assert denied == [], denied

    # Revocation takes effect immediately, with no reindex.
    idx.docs["d1"].acl = {"finance-restricted"}
    assert idx.search("refunds", user_acl={"finance"}, now=10) == []

    # Superseded documents never surface.
    assert all(h["doc_id"] != "d2" for h in
               idx.search("refunds", user_acl={"finance-restricted"}, now=10))

    # Staleness is reported rather than silently served as current.
    assert idx.stale(now=10) == []
    assert set(idx.stale(now=10_000)) == {"d1", "d2", "d3"}
    hits = idx.search("refunds", user_acl={"finance-restricted"}, now=10_000)
    assert hits and hits[0]["stale"] is True, hits

    good = verify_citations("Refunds are processed within 14 days.", ["d1"], idx)
    assert good["trustworthy"], good
    bad = verify_citations("Refunds are processed within 2 days.", ["d1"], idx)
    assert not bad["trustworthy"], bad
    missing = verify_citations("Anything.", ["d99"], idx)
    assert missing["unsupported"][0]["reason"] == "cited doc not in index"

    print("Query-time ACL retrieval + citation integrity: OK")
    print(f"  stale docs at t=10000: {len(idx.stale(10_000))}, "
          f"citation trustworthy good={good['trustworthy']} bad={bad['trustworthy']}")

The SOX control, as code

Segregation of duties over model releases. This is the artifact an assessor asks for under SOX specifically — it is not the same control as the one above, and a system that implements one does not thereby implement the other. It executes under the same publish gate.

"""Segregation of duties over model releases, with an immutable approval chain.

SOX cares about change management over systems affecting financial reporting.
The control that fails is the one where the person who wrote the change also
approved and deployed it, and where the approval record can be edited after the
fact. Both are structural, so both are enforced here rather than reviewed.
"""
import hashlib
import json


class ApprovalChain:
    """Append-only. Each link commits to the previous digest, so an edited
    record breaks verification rather than quietly rewriting history."""

    def __init__(self):
        self.links: list[dict] = []

    def _head(self) -> str:
        return self.links[-1]["digest"] if self.links else "genesis"

    def append(self, action: str, actor: str, change_id: str) -> dict:
        body = {"action": action, "actor": actor, "change_id": change_id,
                "prev": self._head()}
        digest = hashlib.sha256(
            json.dumps(body, sort_keys=True).encode()).hexdigest()
        link = dict(body, digest=digest)
        self.links.append(link)
        return link

    def verify(self) -> bool:
        prev = "genesis"
        for link in self.links:
            body = {k: link[k] for k in ("action", "actor", "change_id", "prev")}
            if link["prev"] != prev:
                return False
            if hashlib.sha256(
                    json.dumps(body, sort_keys=True).encode()).hexdigest() != link["digest"]:
                return False
            prev = link["digest"]
        return True

    def actors(self, change_id: str, action: str) -> set[str]:
        return {l["actor"] for l in self.links
                if l["change_id"] == change_id and l["action"] == action}


class ReleaseGate:
    def __init__(self, chain: ApprovalChain):
        self.chain = chain

    def author(self, change_id: str, actor: str) -> None:
        self.chain.append("author", actor, change_id)

    def approve(self, change_id: str, actor: str) -> None:
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(
                f"{actor} authored {change_id}; approval requires a second person")
        self.chain.append("approve", actor, change_id)

    def deploy(self, change_id: str, actor: str) -> dict:
        if not self.chain.actors(change_id, "approve"):
            raise PermissionError(f"{change_id} has no approval")
        if actor in self.chain.actors(change_id, "author"):
            raise PermissionError(f"{actor} authored {change_id}; cannot deploy it")
        return self.chain.append("deploy", actor, change_id)


if __name__ == "__main__":
    chain = ApprovalChain()
    gate = ReleaseGate(chain)

    gate.author("MODEL-2026-114", "r.khare")
    try:
        gate.approve("MODEL-2026-114", "r.khare")
        raise AssertionError("self-approval was permitted")
    except PermissionError:
        pass

    gate.approve("MODEL-2026-114", "a.controller")
    try:
        gate.deploy("MODEL-2026-114", "r.khare")
        raise AssertionError("author deployed their own change")
    except PermissionError:
        pass

    link = gate.deploy("MODEL-2026-114", "o.release")
    assert chain.verify(), "chain must verify after a legitimate sequence"
    assert link["action"] == "deploy"

    try:
        gate.deploy("MODEL-2026-999", "o.release")
        raise AssertionError("deployed an unapproved change")
    except PermissionError:
        pass

    # Tampering must be detectable, not merely discouraged.
    chain.links[1]["actor"] = "r.khare"
    assert not chain.verify(), "edited approval record still verified"

    print("SOX segregation of duties + approval chain: OK")
    print(f"  links {len(chain.links)}, verifies_after_tamper={chain.verify()}")

System architecture

Query-Time ACL Retrieval with Citation Integrity — the request path, with the decision points that must exist before the first model call:

flowchart LR
    Q[Query + live entitlements] --> SRCH[Search index]
    SRCH --> ACL{ACL match at query time?}
    ACL -->|no| DROP[Drop silently from results]
    ACL -->|yes| SUP{Superseded?}
    SUP -->|yes| DROP
    SUP -->|no| FRESH[Attach version + staleness]
    FRESH --> ANS[Answer + citations]
    ANS --> VER{Cited doc contains the claim?}
    VER -->|no| STRIP[Refuse the citation]
    VER -->|yes| OUT[Answer with verified citations]

Implementation components

1. Query-time ACL — Entitlements evaluated per query against live rights, never baked in.
2. Supersession links — A replaced document is unreachable, not merely lower-ranked.
3. Freshness SLO — Index age per document, with staleness reported on the hit.
4. Citation containment — A cited document must contain a claim-bearing span of the answer.
5. Provenance on the hit — Document id and version travel with the retrieved text.
6. Revocation path — An entitlement change takes effect without a reindex.

Risk mitigation matrix

Each row carries an acceptance parameter rather than an adjective, because "low latency" cannot be signed off. Retention here is bound by per the data class retention schedule, enforced automatically.

Questions to answer before approval

• Reproduce last quarter's figure exactly, using the model version that produced it.
  Version, prompt digest and output digest are recorded per reporting-relevant inference, and versions are pinned per period, so the figure is reproducible on demand.
• A user's access is revoked at 09:00. When does the model stop retrieving that content for them?
  On their next query. Entitlements are evaluated at query time against live rights, so revocation does not wait for a reindex — which is the whole reason index-time ACLs fail.
• What stops a superseded policy document being quoted as current?
  Supersession links. A replaced document is unreachable in search rather than ranked lower, so it cannot surface as a near-miss when the replacement is less similar.
• How do you know a citation actually supports the sentence it is attached to?
  A containment check: a claim-bearing span of the answer must appear in the cited document. A citation that fails is refused, because an unsupported citation manufactures confidence.
• How does a reader know whether the retrieved content is current?
  Every hit carries its document version and a staleness flag derived from the freshness SLO, so content older than the agreed window is visibly old rather than silently current.
• Can a restricted document influence results through similarity without being shown?
  No. Restricted documents are filtered during the scan, before ranking, so they never contribute to the candidate set a user may not read.

Related architectures

• Part of enterprise ai compliance architecture.
• For the related constraint, see SOX reference architecture for enterprise LLM deployment at scale.
• Where this interacts with another regime, see SOX cost control architecture for enterprise LLM deployment.
• A different failure mode of the same component: SOX model release gate and golden set evaluation for enterprise AI.
• SOX vendor evaluation criteria for enterprise AI implementation covers the adjacent case.
• If this is the blocker in front of you: enterprise AI infrastructure review.