We put thirteen models and a keyword rule on the two safety decisions a medical-practice chat makes before it answers. One model caught every message from a writer at risk, and flagged every safe message too. What the board can rank, what it cannot, and why half of it is sealed.
Three vector indexes tied at about 0.90 nDCG@10 on a public benchmark. The chat path built on them did not, and the whole gap was questions that reached the model with no context.
Seven of eight major agent benchmarks were driven to near-perfect scores without solving a task — and every one of those runs would have passed a signature check. The unit of trust is not the number. It is the manifest, and a manifest has to be able to state its own weakness.
EvaluationAttestationBenchmarksRAGContent ProvenanceC2PAOpen StandardsEU AI Act