Approve the sources before the research starts

Every research answer rests on a choice that is easy to skip: which sources were allowed to answer it. When nobody makes that choice, the agent makes it by default, using whatever happens to be reachable at that moment. The result can read well and still rest on a forum thread, an outdated copy of a policy or a vendor's marketing page. Writing the source set down, and approving it before the work begins, is one of the cheapest controls a team can add to agent research.

The source set is the biggest editorial decision

Two careful researchers given the same question and different sources will reach different answers, and both will be able to cite their way there. The question frames what is being asked; the sources decide what can be said. That is why a reviewer who checks only the final answer is checking the wrong half. By the time an answer exists, the sources have already shaped it, and a confident paragraph makes a weak source harder to notice, not easier.

An explicit list, usually called a source allowlist, moves that decision to the front. It says, before anything runs, where the agent may look. It turns a vague expectation (“use reliable sources”) into something a colleague can read, challenge and sign off.

What belongs on the list

A useful allowlist is specific enough that two people would agree on whether a given document is inside it. Entries usually fall into a few kinds:

• Your own material. A project's document collection, a folder of signed contracts, an internal policy library.
• Named primary sources. A particular regulator's publications, a company's own filings, the official text of a standard.
• Specific pages you have exported. A web page captured through an authorized step, kept with its address and the date it was retrieved.
• Explicit exclusions, where they help: drafts, superseded versions, or anything marked as an opinion piece.

Precision matters more than length. “Industry websites” is not an entry; it is a wish. A short list that names three places exactly is easier to approve and easier to audit than a long one that gestures at categories. Here is a small hypothetical example for a question about a supplier's obligations:

question: What notice period does the supplier agreement require for price changes?
sources:
  - project documents: contracts/supplier-agreement-signed.pdf
  - project documents: contracts/amendments/
exclude:
  - drafts/
  - email threads

An empty list means no source

The most important rule is also the least intuitive: if the list is empty, no source is permitted. Not “any source”, not “the agent's judgment”. Nothing.

Default-open behavior seems friendlier, and it is the version that causes trouble. A plan whose allowlist was accidentally left blank would quietly become a plan that may read anything, and nobody would notice until a citation pointed somewhere unexpected. Failing closed makes the mistake visible at once: the run produces no findings, and the reason is obvious. GoCux treats an empty allowlist this way, as permission for no source at all.

The same reasoning applies to partial lists. If a source is not named, it is out, even if it is reachable and even if it would have helped. The agent can report that the answer probably lives elsewhere; it cannot go and fetch it on its own initiative.

Approve the sources together with the plan

Sources should not be approved separately from the question, and certainly not after the answer. A research plan in GoCux holds three things together: the question, the ordered steps and the source allowlist. Creating the plan records a draft. Someone approves it before it runs, and the run that follows cannot widen what was approved.

Approving them as a unit matters because each part constrains the others. The steps only make sense for those sources; the sources were chosen for that question. A reviewer looking at all three can ask the useful questions at once. Will these sources actually answer this? Is anything on the list there only because it was easy to reach? Is a source missing that the answer obviously needs?

When the material you need is not on the list

Partway through, it often becomes clear that the approved sources are not enough. The contract refers to an annex nobody uploaded; the regulator moved its guidance to a new publication. The tempting fix is to add one more source to the running work. Resist it.

Adding material changes what was approved, so it calls for a revised plan rather than a quiet extension. In practice the current run reports what it could and could not answer from the approved set, the gap is recorded as an open question, and a new plan names the extra source and goes through approval like the first one. It feels slower. It is also what keeps the final report honest about where each claim came from. The same holds when the question itself shifts: a changed question needs a new plan covers that case, and missing evidence is an open question covers how to record the gap.

Web pages are sources too, with conditions

GoCux does not read the open web; its knowledge search covers a project's own documents. When web material is needed, it comes in through an authorized browsing or export step and is imported with the original page address and the date it was retrieved, so it can sit on an allowlist like any other document. From web information to reviewable evidence explains why that retrieval context matters. If you already hold the documents, bringing the evidence you already have is usually the faster route.

A checklist for your next allowlist

• Every entry is specific enough that two people would agree whether a document is inside it.
• Exclusions are written down wherever drafts or superseded versions could be mistaken for the real thing.
• The list was approved in the same step as the question and the steps.
• An empty or missing list stops the run instead of opening it up.
• Web pages on the list carry their address and retrieval date.
• When a needed source is missing, the gap is recorded and a revised plan is drafted, rather than the running work being widened.
• Citations in the final answer all point inside the approved set; see citations that hold up for what to check.

The source policy guide describes how these rules are set in a GoCux workspace.