Grounded generation: drafting RCAs without inventing evidence

Large language models are strong at fluent prose and weak at faithfulness to facts not in context. Incident response needs the opposite emphasis: an RCA that is boring, cited, and checkable beats a compelling story that invents a deploy.

Grounded generation is the research line that makes LLMs usable for ops handoff.

Ungrounded vs grounded summarization

Approach	Behavior	Risk
Ungrounded	Model answers from parametric memory	Confident fiction
Grounded	Model must cite provided chunks	Omission or mis-quote
Constrained	Template + slots filled from structured fields	Robotic but safe

Fixed uses grounded patterns for investigate mode: summaries tie to evidence rows, metrics, and timeline events already in the workspace.

RAG for investigations (not generic Q&A)

Retrieval-augmented generation (RAG) in ops is not “search the internet.” It is:

1. Retrieve relevant artifacts: log excerpts, ticket fields, metric annotations, graph paths, past incident neighbors.
2. Pack them into a context bundle with stable ids.
3. Generate text that references those ids (“per evidence E3, pool at 98%”).

Advanced systems add:

• Citation enforcement: post-check that every claim maps to a chunk
• Abstention: “insufficient evidence to claim causation”
• Structured intermediate: JSON timeline before prose RCA

Hallucination modes specific to SRE

Models invent:

• Deploy versions that never shipped
• Services not in the topology
• Fixes that contradict policy (“just restart prod without approval”)

Mitigations that work in production-oriented research:

• Closed-world assumption in the prompt: only entities from the signal map exist
• Tool-verified claims: metric values fetched live, not remembered
• Human-readable diff: show draft RCA next to cited sources

When to use ML vs templates

Not every sentence needs a transformer. High-value LLM uses:

• Translating graph + scores into executive-readable RCA
• Tier-1 phrasing for helpdesk tickets
• Cross-linking jargon (“checkout-svc” ↔ “INC title”)

Low-value uses:

• Re-stating raw numbers already in a table
• Guessing root cause with no retrieval support

Hybrid pipelines (template skeleton + LLM polish on grounded slots) often beat end-to-end generation on factuality metrics.

Evaluation (how research teams measure this)

Academic and industry labs increasingly report:

• Citation precision/recall: did each claim have a correct source?
• Entity hallucination rate: invented services per 1k tokens
• Human edit distance: how much on-call rewrites before send

For buyers, ask vendors for methodology, not adjectives.

Repair mode stays outside generation

Even a perfect RCA generator must not conflate narrative with action. Grounded text can recommend “raise pool limit”; only repair mode + approval should enqueue the playbook.

That boundary is architectural: generation endpoints do not call mutation APIs.

Takeaway

The science behind Fixed-style investigation is less “one smart model” and more retrieve → rank → cite → draft, with graphs and time doing the heavy lifting before language models speak.

Trust comes from constraining what the model is allowed to say, not from larger context windows alone.