Chatbot Hallucination: A Practical Guardrail Guide

The problem is confidence, not invention

Conversations about hallucination usually start with why the model gets things wrong. For a business that is an interesting but unusable question. The usable one is: why does the bot speak with certainty when it has none?

Because that is how you built it. The default behaviour is to answer. Not answering — staying silent, admitting ignorance, handing to a person — is a behaviour that has to be written down explicitly, and usually is not. The bot is not inventing; it is performing the only job it was given.

Framing it this way makes the problem immediately solvable. You do not need a better model. You need four things: a bot that knows what is out of scope, a bot whose answers are tied to your material, a bot that knows what to say when there is no answer, and a way to measure whether those three are working.

Guardrail one: scope

The cheapest guardrail is an explicit list of subjects the bot does not answer at all. This is not prompt work — it is policy work, and it should be agreed with legal or leadership rather than decided by whoever configures the bot.

• Legal advice and contract interpretation. 'What does this clause mean' asks for a legal position, not an answer.
• Medical, financial and regulated advice, unless you hold the licence to give it.
• Comparisons with competitors. The bot does not know a competitor's price or capability, and anything it says becomes a claim made in your name.
• Predictions about the future: when stock arrives, when there will be a discount, when a feature ships.
• Individual exceptions: discounts, deferred payment, returns outside the published policy.
• Facts about third parties — another company's policy, a courier's rules, a bank's terms.

Writing this list takes an hour and removes a large share of wrong answers, because most of them originate in questions the bot should never have been answering.

Guardrail two: grounding in the material

For questions inside scope, the core mechanism is that the bot answers only from material it actually retrieved. That sounds simple and in practice it is three separate decisions.

1. 1What happens when retrieval finds nothing?The right answer is to say so and offer a person. The wrong answer is to construct a reply from whatever was found anyway. This single decision resolves the majority of hallucinations.
2. 2May the bot use general world knowledge?Not on business-specific questions. 'Delivery usually takes three to five days' is a sentence the model wrote from general impression if it is not in your material, and it may be wrong for you.
3. 3Is the answer's source recorded?If there is no record of which piece of material produced a reply, a wrong answer cannot be fixed — only argued about. Source recording is not itself a guardrail, but it is what makes the guardrails fixable.

Guardrail three: the fallback itself

The 'I do not know' answer has to be written too, because a badly written fallback is only slightly better than an invented answer, while a well-written one closes the problem entirely.

• Say specifically what is not known: 'I do not have information about that tariff' beats 'I cannot help with that'.
• Offer an alternative immediately: a transfer, a callback, a specific page or a phone number.
• Write it in every language. An untranslated fallback creates the worst impression at the most visible moment.
• Give it a separate out-of-hours version that names a concrete time.
• Do not pad it with apology. One sentence of regret, then the alternative — that is all.

Different strictness for different risk

Not every question needs the same strictness, and if you apply the same strictness everywhere the bot becomes useless. The practical model is three tiers.

1. 1Low risk — answer freelyOpening hours, address, general product description, how something works. Being wrong is cheap and correctable. The bot should answer comfortably here.
2. 2Medium risk — material only, stated preciselyPrice, delivery times, guarantees, compatibility. The bot should state what is written, should not generalise, and should stop if the material does not cover it.
3. 3High risk — never answered automaticallyLegal, medical and individual financial matters, individual exceptions, complaint resolution. These go straight to a person, with no attempt at an answer.

Tie those three tiers to your material's categories by assigning a tier per category. That is more reliable than a long list of rules held in a prompt, because it applies automatically when new material is added.

How to measure hallucination

1. 1Build a fixed question setFifty to a hundred real questions, with at least ten per cent that your material genuinely does not answer. This set is your instrument.
2. 2Count two different things separatelyWrong answers, and cases where the bot answered when it should have said it did not know. The second is the hallucination indicator and it matters more than the first.
3. 3Track the admission rateOn the unanswerable questions, what share did the bot correctly decline? This should be near total, and on a first measurement it usually is not.
4. 4Read the failuresFor each wrong answer, look at what was retrieved. The cause is almost always empty retrieval, outdated material, or a missing fallback — and all three need different fixes.

Guardrails in Vexvon

In Vexvon answers are tied to retrieval: six results by default over Milvus, each company's material isolated by partition key, and a defined fallback behaviour when no context is found. The question 'what happens when nothing is retrieved' therefore has a built-in answer rather than an accidental one.

Answer transparency records which pieces of knowledge were used — the mechanism that makes the 'look at what was retrieved' step in the measurement section above possible. A wrong answer becomes a specific entry to edit rather than a debate.

Scope and risk tiers are managed through the material: entries are typed into thirteen categories, can be deactivated individually, and are targeted at the chatbot, the call agent or both. Prompt versions are tracked with one active at a time and a path back to the previous one, so a guardrail change is a reversible operation.

On the escalation side the AI can stop itself: a request for an operator raises a notification, abusive language acts as a stop condition, and an agent's stop character pauses the AI on that conversation for thirty minutes. That is the mechanism the high-risk tier depends on.

Frequently asked questions

1. 1What is chatbot hallucination?It is the bot confidently stating something that is not in your material. For a business the problem is the confidence rather than the invention — customers forgive an admission of ignorance but not an invented date.
2. 2Does a better model fix it?Partly, and less than expected. Most hallucinations originate in a question the bot should not have answered at all, in empty retrieval, or in an unwritten fallback. None of those three depends on the model.
3. 3What should be out of scope?Legal advice, medical and financial advice you are not licensed to give, competitor comparisons, predictions about the future, individual exceptions, and facts about third parties.
4. 4What makes a good fallback?It should say specifically what is not known, offer an alternative immediately, exist in every language, have a separate out-of-hours version, and not be padded with apology.
5. 5How do you measure hallucination?Build a fixed question set with at least ten per cent unanswerable questions and track the share the bot correctly declines. That figure matters more than the raw count of wrong answers.
6. 6When should a person take over?On every high-risk question, whenever retrieval finds nothing, on an explicit request, and on complaints.

Start with five unanswerable questions

The fastest way to assess your guardrails is to write five questions your material does not answer and put them to the bot. Five honest admissions means the core mechanism is in place. A single invented answer means the thing to fix is not the model — it is the fallback and the grounding.