By Greg Nowak. Last updated 2026-08-28.
A citation reassures a reader. A source trail lets a team approve the work.
That distinction matters when an AI research assistant produces competitor scans, sales briefs, market summaries, or content research. A polished answer with three links may look credible, but the person signing it off still needs to know what was searched, which sources were consulted, what rules shaped the search, and whether anyone checked the important claims.
This is where AI research stops being a clever prompt and becomes an operational workflow. The goal is not to eliminate judgement. It is to make that judgement faster, more consistent, and easier to inspect.
A citation and a source trail do different jobs
OpenAI’s current web search tool returns inline URL citations by default. Those citations identify the sources attached to particular passages, and OpenAI requires them to be visible and clickable when web-derived information is shown to end users.
The Responses API can also return web_search_call.action.sources. This is the broader list of URLs the model consulted during the search, which may be longer than the list of sources cited in the final answer.
Both are useful, but for different people. Readers need citations close to the claims they support. Editors, account leads, and operations teams need the wider source record so they can spot weak domains, missing primary evidence, or an unexpectedly narrow search.
Do not oversell that record. It shows the consulted URLs; it does not prove that every conclusion is correct, explain why one source outweighed another, or preserve a page that may later change. A useful audit trail therefore combines API output with records created by your own application.
Put source policy into the tool configuration
The current web search configuration supports domain filters through allowed_domains and blocked_domains. That is stronger than merely asking the model to “use reliable sources.” A medical workflow might restrict research to regulators and recognised institutions. An agency workflow could prioritise the client’s site, official product documentation, government registers, and an approved publisher list.
A compact JavaScript implementation looks like this:
const response = await client.responses.create({
model: process.env.OPENAI_MODEL,
tools: [{
type: "web_search",
filters: {
allowed_domains: approvedDomains,
blocked_domains: excludedDomains
}
}],
include: ["web_search_call.action.sources"],
input: researchBrief
});The domain policy should vary by assignment. A strict allowlist is sensible when authority matters more than discovery. A broader search is more useful when mapping an unfamiliar market, provided the result goes through a stronger review gate. One universal list rarely serves both purposes well.
If the assistant researches documents supplied by your team rather than using OpenAI-hosted web search, citations need separate design. OpenAI’s citation-formatting guidance recommends stable, inspectable source units and identifies block-level citations as a practical default for many systems. In other words, divide internal material into meaningful chunks, give each chunk a stable identifier, and retain that identifier through drafting and review.
The production workflow I would use
| Stage | Record | Owner | Release gate |
|---|---|---|---|
| Brief | Question, audience, date range, approved domains | Requester | Scope is specific enough to research |
| Search | Queries, consulted URLs, retrieval time | Application | Required source types are present |
| Draft | Answer, inline citations, prompt and model version | Application | Material claims have support |
| Review | Corrections, rejected sources, reviewer decision | Editor or subject owner | Conflicts and commercial risks are resolved |
| Publish | Approved output and final source references | Channel owner | Links render correctly and approval is recorded |
The application should retain enough information to reproduce the business decision: the original brief, source restrictions, response identifier, model and prompt version, consulted URLs, cited claims, timestamp, and reviewer outcome. For higher-risk work, also preserve an approved copy or excerpt of decisive evidence, subject to copyright and data-retention rules.
OpenAI’s current prompt-engineering guidance recommends keeping production prompts in application code, where typed inputs, code review, tests, and normal deployment controls can be used. That is particularly relevant here: source rules, required output fields, escalation conditions, and review flags are business logic. They should not live in an untracked prompt pasted into a dashboard.
What the API cannot decide for you
Source controls are not the same as editorial policy. Your team still needs to decide what qualifies as adequate evidence. Is one official source enough? Must pricing be checked on the day of publication? Should disputed claims show both positions? Which topics require legal, medical, financial, or subject-matter review?
It also helps to define failure behaviour before launch. If the assistant cannot find an approved source, it should report the gap rather than quietly widening the search. If sources conflict, the output should surface the disagreement instead of blending it into a confident average. If a key link cannot be reopened during review, the brief should remain a draft.
A practical launch checklist
- Define source rules separately for each research use case.
- Capture consulted URLs as well as reader-facing citations.
- Make citations visible and clickable in the final interface.
- Keep prompts, schemas, and source policies under version control.
- Test known-good, conflicting, outdated, and insufficient-evidence cases.
- Assign a named owner for approval and exceptions.
- Measure unsupported claims and reviewer corrections, not just speed.
Build for review, not citation theatre
The best AI research assistant is not the one that produces the longest source list. It is the one that helps a busy team see what was checked, recognise what remains uncertain, and make a defensible decision without repeating the entire search.
If your agency or operations team needs that kind of workflow, Greg can help shape the source policy, implementation, review gates, and handoff into your existing content or commercial process. Talk to Greg about the project.
Related on GrN.dk
- When Google can call the business, your local data stops being cosmetic
- OpenAI Computer Use: Browser Agents Need Credentials, Not Demos
- AI disclosure rules belong in your CMS, not a spreadsheet
Need help with this kind of work?
Plan a governed AI research workflow Get in touch with Greg.
