How AI Agents Cite Sources: Auditable AI Citations

A citation is a checkable claim, not a courtesy

When an agent writes "this fund cut its largest position last quarter," that sentence is either a retrieval result or a plausible invention, and nothing in the prose tells you which. Language models produce both with identical confidence, and academic work has generally found that prompting alone ("do not make things up") barely moves the failure rate. The structural fix: require every factual claim to carry a citation resolving to a primary document, so the reader (human or agent) can verify it without trusting the model. Model-side failure modes are covered in How to Stop Your AI from Hallucinating Market Data; this piece is about the citation itself.

Most of what passes for AI citation today fails the audit test. A footer that says "data from public sources" is unfalsifiable. A link to a vendor's own dashboard moves the trust problem one hop sideways. The standard worth building to is per claim, per document: each number maps to exactly one source record, the record names exactly one filing, and the filing lives on infrastructure the vendor does not control. For US securities data that infrastructure exists and is free: SEC EDGAR.

Auditable also means structured, not prose. "According to the fund's Q1 13F" is a sentence; a CIK plus an accession number plus a filing date is a key a program can resolve, deduplicate, and verify automatically. Agents consume citations far more often than humans do, so the format has to be machine-first.

The anatomy of a machine-readable citation

A useful citation carries enough fields that both a script and a skeptical analyst can act on it without a second lookup:

Two details do most of the work. First, the split between "period of report" and "filed at" is what makes staleness visible: a 13F describes positions as of quarter end, but the world may not learn about them until 45 days later. A citation carrying only one date hides that gap. Second, the accession number anchors the citation because it is permanent, unique, and hosted by the regulator: one string (filer CIK, two-digit year, sequence number) locates the exact document forever, resolvable by anyone through EDGAR full-text search.

Citations must also be row-level, not response-level: an answer synthesized from three filings needs three source records, each keyed to the numbers it backs. A single "sources" blob at the bottom forces the auditor to guess which document supports which claim.

Deadlines turn citations into freshness metadata

The form type in a citation does double duty: it names the legal clock the data was filed under, which bounds how stale the number can possibly be. An agent that knows the deadline schedule can answer "how fresh is this?" from the citation alone.

The 13F applies to institutional managers above $100 million in covered US equities; the SEC's own Form 13F FAQ is the canonical reference for edge cases. The full 2026 calendar is covered in 13F Filing Deadlines 2026.

This is why a good citation UI shows the form type and both dates next to every number rather than hiding them in a tooltip. "Held as of 2026-03-31, per a 13F filed 2026-05-15" is a different claim than the bare number, which invites the reader to assume it describes today. The cited version states exactly what is known and when it became known.

How citations travel over MCP and REST

Whether an agent connects through an MCP server or plain REST, citations should arrive in-band: the same payload that carries the number carries its source. Out-of-band provenance (a separate "get sources" call) gets skipped under token pressure and breaks the per-claim mapping. Arkolith returns provenance per row, so the pattern looks like this:

# Resolve an entity to its CIK first
curl -H "Authorization: Bearer YOUR_KEY" "https://arkolith.com/api/v1/search?q=berkshire"

# Pull holdings; every row carries the accession number of the filing it came from
curl -H "Authorization: Bearer YOUR_KEY" "https://arkolith.com/api/v1/funds/1067983/holdings"

# Enumerate covered institutions
curl -H "Authorization: Bearer YOUR_KEY" "https://arkolith.com/api/v1/funds"

Scale is the point. Arkolith's Q1 2026 13F dataset covers 1,824 institutional filers and 1.87 million long positions representing $53.7 trillion in reported value, plus 51,000+ tracked insider transactions from Form 4 filings, and every row resolves back to the accession number of the filing it was parsed from. Provenance that exists for a demo dataset but degrades to "trust the aggregate" at production scale is not provenance.

On the agent side, the enforcement rule is one line of system prompt: no citation, no claim. The model may only state numbers present in tool results, and must emit the source key alongside each. Because the source fields sit in the same JSON the number came from, the model passes them through rather than composing them: the difference between citing and confabulating. Setup takes minutes via the quickstart, and the full tool surface is documented at /docs.

UI patterns that make audits take seconds

Structured citations still fail if the interface buries them. The patterns that hold up:

Inline receipt chips. The source stamp sits next to the number it backs, not in a references section at the bottom. Claim-to-source distance is the metric: every centimeter between a figure and its citation is a centimeter the auditor has to bridge by guessing.

One-click primary documents. The chip links to the filing itself on EDGAR, or to an intermediate page that puts the EDGAR link one click away. Arkolith's human surfaces work this way: the institutional holders table on a stock page like NVDA and the position history on a fund page stamp filing-derived figures with their disclosure source.

Freshness badges. "As of 2026-03-31, filed 2026-05-15" rendered as a badge, with visual aging once the period of report falls more than a quarter behind.

Amendment indicators. Filings get amended, and a number sourced to an amendment is a different evidentiary object than one from the original. Mark which one the reader is looking at.

Footnote keys for chat. In conversational agent UIs, bracketed keys in the text that resolve to an expandable sources panel beat inline URLs, which models truncate and users never click.

What a citation cannot prove

A citation proves chain of custody, not truth. If the filer reported a wrong number, a perfectly cited pipeline reproduces the wrong number with a beautiful receipt attached. Filers do make mistakes; amendment mechanisms exist precisely because original filings are sometimes wrong, and errors in disclosure data often surface quarters later through amended filings. The citation's job in that scenario is to make the error traceable and attributable, not impossible.

There are also category limits. 13F data is long-only, US-listed, and quarterly, so even a flawlessly sourced holdings table is a partial portrait of a manager's book; How Accurate Is 13F Data? walks through what the form structurally cannot show. And any derived figure (a sector aggregate, a quarter-over-quarter delta) is a computation over filings rather than a filing, so its citation must name the input documents and the method, not pretend the output appeared in a filing somewhere.

None of this weakens the case for citations. It defines their honest scope: a cited answer is an answer you can check, dispute, and correct. An uncited answer is a vibe. For agents operating on financial data, where a confident wrong number is worse than no number, checkable is the only acceptable default.

Frequently asked questions about how AI agents cite sources

What should a proper AI citation contain?

At minimum: a permanent document identifier (the accession number for SEC filings), the filer's CIK, the form type, the period of report, the filing date, and a URL that resolves to the primary document. The fields should be structured JSON in the same payload as the data, so programs can verify them mechanically.

Why are EDGAR accession numbers the preferred anchor for financial citations?

They are permanent, globally unique, free to resolve, and hosted by the regulator rather than by any data vendor. One string locates the exact filing forever, which makes a claim falsifiable by anyone with a browser.

Can an AI agent fabricate a citation?

Yes. A model can invent a plausible-looking accession number just as easily as a plausible-looking price. The defense is architectural: source fields must be passed through from tool results rather than composed by the model, and a verification layer can resolve each accession number against EDGAR before the answer renders.

Do per-claim citations make agent responses slower or more expensive?

They add payload size but no extra retrieval, because in-band provenance arrives in the same response as the data. The token overhead is modest, and for metered APIs the citation fields are part of the row rather than a separate billable call. The real cost comparison is against shipping an unauditable answer.

This article explains public filings and data concepts. It is not investment advice.