Tools · LLM application security · 08 / 23
A model reply is not the record of what happened
Text the model emitted is a generated sentence. Write the model id, the response id, and the time. Cite the application’s own log for any claim that a tool ran or a record changed.
The reply is generated text
When an assistant answers, the product stores a string the model produced. That string can describe an action in the past tense. The sentence is not the action. A roster bot can say it updated a room while the schedule service never received a call.
People paste the reply into tickets because it is readable. The ticket then treats a generated sentence as the evidence. The evidence of a change is the service that owns the record.
Put the reply next to the service log
If the reply claims a write, open the log of the service that would have performed it, for the same request id and the same minute. Quote the reply as “model text” and the log line as “service record.” If there is no service line, the note says the claim is unsupported.
Do not “fix” a missing log line by asking the model whether it really did the thing. A second sentence is still model text.
What to file
File the response id, the model id, the UTC time, and the request id that ties the turn to your logs. File a short quote only if it contains no secrets and no customer text you would not put in a ticket. File the service log line, or an explicit “no matching service line.”
Worked case: “the room was updated”
Roster bot reply r-441 says “Room B is now booked for Friday.” The schedule service log for request req-441 has no write. The only line is a read of the current board. A draft closes the ticket as done because the reply sounds finished.
The note quotes response r-441 as model text, model id and time, and “no write in the schedule log for req-441.” The room is not marked booked. The reply stays attached so a reader can see what the bot said, labeled as generated text.
response: r-441 model: lab-roster-2026-10 time: 2026-11-03T15:01:12Z request: req-441 model text: "Room B is now booked for Friday." schedule log: read only, no write cite the write: no
Diagram
A reply versus the service that owns the record
Only one of these is a change.
Is. Text the model emitted
Can say. That a booking or a message happened
Proves. What the product showed the user
Is. The schedule or mail system’s own line
Can say. Whether a write was accepted
Proves. The change, or that there was none
Check yourself
1. The assistant says it updated a record. What is that sentence?
2. There is no service line for the request id. What do you write?
3. Why keep the model id with the quote?