Methods · Topic T3

How an LLM should be made to answer with the company’s data, without making things up

Reviewed October 18, 2026

It prints in full from the browser, on A4 or Letter.

Block 1

The problem

Making the model answer with the company’s data and not hallucinate, and measuring that it does.

Summary in three lines

The model is not asked to remember: the knowledge lives in versioned content that is indexed before the question, and the model only receives the few passages that retrieval picked, each with its provenance.
Controls go in layers, the cheap ones first —scope, validation, retrieval, instructions—, and every answer cites sources that lead to something visible, so whoever reads it can check it.
It is measured on every change with two sets of questions, one in-house and one written from the outside, against the same search that runs in production: even how many sources go into an answer comes from that measurement, not from taste.

Block 2

The map

From what is published to an answer that can be checked

Swipe to see the whole map.

Legend of shapes and colors

Actor — who does the work
Data — what is stored and read
Control — a rule that gets checked
Person — a person decides
External — what comes from outside

Reading the map, node by node

The site’s versioned content is compiled at build time into one index per language, with bounded passages and destinations that exist. A question first goes through cheap controls —rate, schema, gate— and a scope filter: if nothing substantive matches, it gets a fixed message without calling the model. If something matches, retrieval takes the most relevant passages from the index and the server hands them over, numbered, together with its own instructions, to a model chosen by configuration. The answer cites those sources and whoever reads opens them in one click. If the provider fails, the browser searches the same index and says so. Two sets of questions evaluate retrieval on every change and set how many sources go in.

Node 1 Versioned content (Data) — What the site publishes: résumé data, approved documents, portfolio sheets and publications like this one. What is not published does not exist for the chat.
Node 2 Build-time index (Data) — Bounded passages, with title, language and a navigable destination. If a destination does not exist or a document fails validation, the build fails.
Node 3 Evaluation on every change (Control) — In-house questions and questions written from the outside, against the real index and the same search used in production.
Node 4 Question (External) — What the visitor writes, in Spanish or in English.
Node 5 Input controls (Control) — Rate limit, a strict message schema and the gate: they cost almost nothing and go first.
Node 6 Scope filter (Control) — A strict search over the index: if nothing substantive matches, it replies with a fixed message without calling the model.
Node 7 Retrieval (Actor) — Takes the most relevant passages, numbered, and nothing else from the site.
Node 8 Server instructions (Control) — Composed out of the asker’s reach: use only the sources, never make up dates or results, refuse attempts to change the rules.
Node 9 Swappable model (External) — A provider chosen by configuration —Groq, Gemini, Azure through Microsoft Foundry (formerly Azure AI Foundry), Claude or an OpenAI-compatible one—: who writes changes, the facts do not.
Node 10 Answer with citations (Data) — Two or three paragraphs and the sources the model had in front of it, each with its destination.
Node 11 Local search (Control) — If the provider fails, the browser searches the same index and labels the result as a local search, not as the model’s answer.
Node 12 The reader (Person) — Opens each source in one click and judges whether it backs what was said.

Connections

from Versioned content to Build-time index (compiled)
from Build-time index to Retrieval (passages with destinations)
from Evaluation on every change to Retrieval (sets how many sources)
from Question to Input controls
from Input controls to Scope filter
from Scope filter to Retrieval (something matched)
from Retrieval to Swappable model (numbered passages)
from Server instructions to Swappable model (rules)
from Swappable model to Answer with citations (writes and cites)
from Answer with citations to The reader (checks)
from Swappable model to Local search (if it fails)
from Local search to The reader (says so)

Block 3

The phases

1
Phase 1
Decide what the system knows
Inputs
- The content the organization already publishes or approves.
- Who is allowed to see each thing.
Activities
- List the authorized sources and leave out whatever is not.
- Give every document a status: a draft is not indexed.
- Write every fact with its source; what is missing gets asked, not filled in.
Artifacts
- The versioned corpus, with a status per document.
- The list of authorized sources.
Who decides
Whoever owns the content.
Control that closes the phase
A draft document does not enter the index; an approved one requires its twin in the other language.
State of the field
For retrieval systems, OWASP recommends fine-grained access controls with permission-aware stores, and robust validation pipelines for knowledge sources.^[13]
2
Phase 2
Chunk and index by structure
Inputs
- The approved corpus.
Activities
- Cut along the document’s structure —the subsection—, with a size cap measured on the real corpus.
- Split whatever exceeds the cap into windows that keep the same anchor.
- Store with each passage its title, its language and the visible destination it leads to.
- Check every destination against the site’s real routes.
Artifacts
- One index per language, inspectable and regenerated on every build.
Who decides
Whoever builds, with the measurement alongside.
Control that closes the phase
The build fails if a document does not validate, an identifier repeats or a destination does not exist.
Evidence
The 180-word cap per passage was measured on the real corpus: the typical subsection had 143 words and the longest 247, and with that cap only 4% of the subsections get split.
3
Phase 3
Retrieve, and measure how many sources go in
Inputs
- The index.
- A set of questions, each with the source it expects.
Activities
- Choose the type of search by measuring, not by habit.
- Use the question set to fix how many sources go in and how much each kind of passage weighs.
- Separate two modes: a broad one to answer and a strict one to decide whether to answer at all.
Artifacts
- The search configuration, versioned and with its measurement alongside.
Who decides
Whoever builds, with both question sets in front of them.
Control that closes the phase
No question in the set is left without its source among those that go in.
Evidence
With three sources per answer, six questions in the bank were left without theirs; with four, none, and with five the context grew by 25% without rescuing anyone: that is why four go in.
4
Phase 4
Control before and after the model
Inputs
- The question.
- The retrieved passages.
Activities
- Stop off-topic questions before calling the provider.
- Compose the instructions on the server, out of the asker’s reach.
- Bound the input, the history and the output with numbers, not intentions.
- Turn every source used into a citation that navigates.
- Fall back to local search, and say so, if the provider fails.
Artifacts
- The server’s defenses, in order, each with its provoked-failure test.
Who decides
Whoever answers for the product.
Control that closes the phase
Every control is seen failing in the suite before it is accepted.
Evidence
This chat’s server has nine defenses in order; only the last one —the provider— comes with a bill, and it is reached once the eight before it have done their job.
5
Phase 5
Evaluate retrieval before publishing a change
Inputs
- The change: content, configuration or code.
- The two question sets.
Activities
- Run each document’s own questions and those written from the outside against the real index, with the same search module production uses.
- Check that off-topic questions behave as declared.
- Read the answers to the in-house questions: every claim supported, nothing from outside the corpus.
- Treat a word the corpus does not say as a content finding, not a test problem.
Artifacts
- The result of both suites in continuous integration.
- A required vocabulary per document.
Who decides
Whoever owns the content, with continuous integration in front of them.
Control that closes the phase
A change that leaves a question without its source does not get published.
Evidence
When the bank found that “ETL” and “lakehouse” did not appear in the author’s documents —which said “information integration”—, the content was fixed, not the expectation.
6
Phase 6
Operate, degrade and measure again
Inputs
- The released chat.
- The record of every answer.
Activities
- Watch the cost, latency and mode of every answer: model, fixed message or local search.
- Measure the threshold and how many sources go in again every time the corpus grows.
- Turn every badly answered question into a new row in the bank.
Artifacts
- One row per answer: sources, provider, tokens and milliseconds.
Who decides
Whoever pays for the operation and whoever owns the content.
Control that closes the phase
A written spending ceiling; if it gets close, context or length is trimmed before switching models.
Evidence
It runs under a ceiling of US$20 a month with an observed real cost of US$0: usage fits in the initial provider’s free quota and off-topic questions never call it.

Block 4

The design decisions

Why the RAG does not use embeddings: lexical, vector or hybrid
When yes
Lexical, when the content is full of names, dates, acronyms and technical terms, and the test questions show no lost paraphrases.
When no
When a family of questions phrased in words the content does not use —synonyms, paraphrases— is lost systematically: that is where vector or hybrid search pays for what it costs.
Why
State of the field
Microsoft documents that keyword search performs better on product codes, highly specialized jargon, dates and people’s names because it finds exact matches, while vector search finds what is conceptually similar even without shared words; hybrid search runs both in parallel and merges the results.^[1]
Evidence
This site’s chat searches with BM25, without embeddings or a vector database, by a written decision: they come in the day the bank shows a family of questions that lexical search loses systematically, and today none is left without its source among the first four.
Whether to rerank the results
When yes
When the first search brings back the right thing, but not near the top, and only a few passages fit in the context.
When no
When the right thing already comes out on top in the measurement: a reranker adds latency and cost to every question without moving anything.
Why
State of the field
In Azure AI Search the semantic ranker reranks only the top 50 results of the keyword or hybrid search, using language models adapted from Bing; it does not search the whole corpus again, so it cannot rescue what the first search missed.^[2]
Judgment
Before adding a reranker, it is worth looking at where the right source lands: if it already comes in among the first ones, the reranker is just spending.
How many sources go into an answer
When yes
More sources, when the measurement shows questions left without theirs.
When no
When raising the number no longer rescues any question: it only grows the context, the bill and the noise the model has to ignore.
Why
State of the field
Microsoft suggests calibrating search parameters —the algorithm, top_k, passage size— with a sweep: generate results with different values and keep the ones that give the best retrieval quality, measured against human-labeled relevance.^[7]
Evidence
In this site’s chat two independent sets measured it, twice: with four sources per answer, the golden set scored 75 out of 75 and the bank 136 out of 136; with five, not one more was rescued.
What the chat does when the question is not its business: the scope threshold
When yes
A filter before the model, for questions that share not a single substantive word with the content: they are answered without spending a token.
When no
As a guarantee of correctness: if the threshold rises to block more off-topic questions, it starts rejecting legitimate ones.
Why
Evidence
It was measured and the finding was negative: the lowest-scoring legitimate question gets 5.92 and the highest-scoring off-topic one, 16.90; with the threshold at 7, ten legitimate questions got “that one escapes me” in exchange for blocking three more off-topic ones. That is why the threshold is 1 —“something substantive matched”— and correctness is guaranteed by the prompt.
Judgment
The worst failure for a chat like this is not spending tokens on an off-topic question: it is answering “I don’t know” to a legitimate one.
How the chat avoids making up answers: sources that are cited and can be opened
When yes
Always: every source that goes into the answer leads to a visible section, and a broken destination stops the build.
When no
It is not enough when the answer has consequences: there a machine check is also needed that every claim rests on the source it cites.
Why
State of the field
OWASP lists misinformation among the risks of LLM applications and recommends, among other measures, using retrieval-augmented generation to make outputs more reliable, encouraging users to cross-check them against trusted sources, and automatically validating key outputs, especially in high-stakes settings.^[14]
Evidence
In this site’s chat, the sources the model had in front of it appear next to the answer and each one leads to its section; as of this publication’s review date there is no validator that checks the model used each source in each sentence, and it is stated as such: that relationship is checked by whoever reads.
Send everything in the context, or retrieve: when not to use RAG
When yes
Send the whole content when it fits comfortably in the model’s window and changes little: there is no index to maintain.
When no
When the content grows, changes often or mixes topics: with more text in front of it the model performs worse and every question costs more.
Why
State of the field
Anthropic says that if the knowledge base is smaller than 200,000 tokens —about 500 pages— it can simply be included whole in the prompt; Chroma measured 18 models and found that their performance degrades as input grows, even on simple tasks.^[4]^[9]
Evidence
With four sources of up to 180 words, the context of an answer in this site’s chat stays around 540 words —on the order of 800 tokens—, even though the knowledge base has grown from about 30,000 to about 158,000 words per language.
Prompt caching yes; semantic caching, not in a chat about facts
When yes
Prompt caching, when many calls share the same beginning —instructions, fixed context—: it lowers cost and latency without touching the answer.
When no
Semantic caching, when the answer depends on facts that change or on the nuances of the question: it returns the answer to a different, similar question.
Why
State of the field
Microsoft documents that prompt caching does not change the content of the answer, it only reduces latency and cost, and that it requires an identical beginning of at least 1,024 tokens; about semantic caching it warns that, because it answers by similarity rather than exact match, it can return responses that are incorrect, outdated or unsafe for the current request.^[10]^[11]
Judgment
A semantic cache does not belong in a chat that answers about facts without a log showing repeated questions: returning another question’s answer because it looks similar is an elegant way of making things up.

Block 5

What is new in 2026

State of the field
Hybrid search with semantic reranking
What changes from common practice
Instead of choosing between words and meaning, search runs lexical and vector retrieval in parallel, fuses both lists by reciprocal rank and a language model reranks the top results. Microsoft documents that, in tests on real-world and benchmark data, hybrid retrieval with the semantic ranker offers significant relevance gains.^[1]^[2]
Judgment
If one day the bank shows lost paraphrases, this is the next step, not a replacement: lexical search would stay for names and acronyms.
State of the field
Agentic retrieval: the question is planned before searching
What changes from common practice
For questions with several parts, or that depend on the conversation, a model splits them into subqueries that run in parallel, each one is reranked and the result is merged with references for citation. Microsoft warns that it adds latency compared with a single query, and in Azure AI Search model-based query planning is still in preview.^[3]
Judgment
For short, direct questions, that latency is only worth paying if the measurement shows compound questions left without their source.
State of the field
Context added to each passage before indexing it
What changes from common practice
A loose passage loses which document and which section it came from. Contextual retrieval prepends a short explanation, generated from the whole document, before the embeddings and the BM25 index: in Anthropic’s tests, retrieval failures among the top 20 passages fell by 49%, and by 67% with reranking added.^[4]
Evidence
In this site’s index every passage keeps its section title, the title weighs twice as much as the body, and every document also declares when to use it: it is context written by hand, with no model in between.
State of the field
GraphRAG for questions about the whole dataset
What changes from common practice
Vector RAG excels at local questions —who, what, when, where—; answering global questions about an entire dataset is GraphRAG’s advantage. Its LazyGraphRAG variant brought indexing cost down to that of vector RAG: 0.1% of full GraphRAG’s.^[5]
Judgment
This site’s questions are local —a company, a figure, a decision—; a graph would pay off if questions came about patterns across the whole career and the bank showed they go unanswered.
State of the field
Citations anchored to the exact sentence
What changes from common practice
Anthropic’s citations API splits documents into sentences and returns, with the answer, the exact sentences that support it; according to its internal evaluations it outperforms most custom implementations, with up to 15% better recall accuracy.^[6]
Evidence
This chat’s citations reach the section, not the sentence: the destination is guaranteed on every build; the link to each sentence is not.
State of the field
Evaluating retrieval and the answer separately, with a judge calibrated against people
What changes from common practice
Microsoft separates process evaluation —whether retrieval brought back what is relevant, measured against human labels in the document-retrieval evaluator or by a model judge in the retrieval evaluator— from system evaluation: whether the answer rests on the context without making things up, which is precision, and whether it leaves nothing essential out, which is recall. When the judge is a model, LangSmith proposes grading a sample by hand first and adjusting the judge’s instructions until it agrees with those grades.^[7]^[8]
Evidence
In this site’s chat retrieval is evaluated on every change with two sets, against the real index and with the same search module that runs in production.
State of the field
Long context does not replace retrieval
What changes from common practice
Large context windows invite sending everything. Chroma measured 18 models and saw that performance drops as input grows, that a single distractor already lowers it and that how the information is presented matters: choosing what goes in is still the job.^[9]
Evidence
This site’s chat hands the model only the retrieved passages, numbered, and not the site’s whole content.
State of the field
Outputs that follow an exact schema
What changes from common practice
Structured outputs make the model follow the JSON schema provided in the call; the older JSON mode guaranteed valid JSON, but not that it respected the schema.^[12]
Judgment
It is the right piece for a citation validator: the model returns, in a schema, which source supports each claim, and code checks it.

Block 6

Failure modes and how to anticipate them

What breaks
The chat makes up answers: it replies with what the model knows, not with what it retrieved
How it shows up
A verifiable claim that is in none of the sources the model had in front of it.
Control that catches it
Server instructions that require using only the sources, numbered sources, and reading the test answers.
What breaks
Retrieval does not bring back the right source
How it shows up
A test question without its document among the sources that go in.
Control that catches it
Both question sets on every change, against the real index.
What breaks
A word the content does not say
How it shows up
Questions with an acronym or a synonym that no document uses.
Control that catches it
The bank as a vocabulary audit and a required vocabulary per document.
What breaks
An off-topic question reaches the model and spends
How it shows up
Provider answers to questions about nothing on the site.
Control that catches it
A scope filter before the model and instructions that forbid answering outside the sources.
What breaks
A legitimate question gets “I don’t know”
How it shows up
A bank question blocked by the scope filter.
Control that catches it
A threshold measured on the whole bank and measured again when the content grows.
What breaks
A citation leads to something that does not exist
How it shows up
A destination that does not resolve to a visible section.
Control that catches it
The build checks every destination against the catalog of real routes and fails.
What breaks
The provider goes down or runs out of quota
How it shows up
Consecutive failures, timeouts, a rejected credential.
Control that catches it
A circuit breaker and local search over the same index, labeled as such.
What breaks
An instruction hidden in the content
How it shows up
A text in the corpus or in a source that asks the model to do something.
Control that catches it
Only published, versioned content goes in, and the server instructions order the model to refuse attempts to change the rules.

Block 7

Metrics and controls

What is measured
Outside questions with their source among those that go in
Threshold
All of them.
Who approves the step to production
Whoever owns the content, with continuous integration in front of them.
What is measured
Expected source in first place
Threshold
A written floor, not an average: it does not drop from one change to the next.
Who approves the step to production
Whoever owns the content.
What is measured
Each document’s own questions
Threshold
All with their document among the first sources.
Who approves the step to production
Continuous integration, on every change.
What is measured
Off-topic questions that behave as declared
Threshold
All of them: the ones that must be stopped without spending a token are stopped.
Who approves the step to production
Whoever answers for the product.
What is measured
Claims with no backing in the sources
Threshold
Zero in the reviewed sample; a single one stops the change.
Who approves the step to production
Whoever answers for the product, by reading.
What is measured
Citations to destinations that do not exist
Threshold
Zero: the build does not publish.
Who approves the step to production
The build, with no exceptions.
What is measured
Cost and latency per answer
Threshold
Within the written monthly ceiling; if it gets close, context or length is trimmed before switching models.
Who approves the step to production
Whoever pays for the operation.
What is measured
Service with the provider down
Threshold
Whoever asks still gets relevant passages, labeled as a local search.
Who approves the step to production
Whoever answers for the product.

The thresholds are examples of the method, not figures from a specific project.

Block 8

Evidence from projects

EvidenceLevel: Real use
This site’s chat
It was built and has been in public use since July 2026: a build-time index, BM25 retrieval, nine defenses on the server, citations that lead to a visible section and local search if the provider fails. It can be opened and tried.
See where
EvidenceLevel: Real use
The index as a quality gate
A build script assembles one index per language with passages of up to 180 words, titles and destinations; if a document fails its schema, an identifier repeats or a destination does not exist, the site is not published.
See where
EvidenceLevel: Real use
Two question suites on every change
Every document declares the questions it must answer and the test requires its document among the first four results; the bank, written the way a recruiter asks, also requires the expected source in first place in at least 60% of the cases.
EvidenceLevel: Real use
How many sources and how much each weighs, measured
The four sources per answer came from two measurements with two independent sets —with four, 75 out of 75 and 136 out of 136—, and the 0.5 weight on the portfolio sheets brought the bank back from 94 to 102 hits out of 131.
EvidenceLevel: Real use
The layer that adapts the provider, one environment variable
An environment variable chooses among five providers adapted and integrated on the Vercel AI SDK: Groq, the initial one, chosen in July 2026 —running gpt-oss-120b since August, because Groq retired the earlier model—, Gemini 2.5 Flash, Azure through Microsoft Foundry, Claude with Haiku 4.5 and any service compatible with the OpenAI API. The index and the defenses do not change.
EvidenceLevel: Real use
Degradation, tested by a real failure
In sprint 3 a provider credential returned a 401 in integration, the circuit opened and local search answered over the same index, saying it was not the model’s answer.

Block 9

Limits and scope

Evidence
Embeddings and a vector database are out of this chat by a written decision, not for lack of knowing them: vector search was compared with lexical search, and they come in the day a measurement justifies it.
Evidence
As of this publication’s review date there is no validator that checks the model used each cited source in each sentence: it is declared future work.
Evidence
For the answer there is no automatic validator: the test answers are reviewed by reading them.
Evidence
The chat does not fine-tune or retrain any model, and it is not for lack of knowing how: the author fine-tuned models on Microsoft Foundry, in several prototypes of the author’s own. A fine-tune changes how a model behaves; what changes in the author’s career changes at the source and enters the index on the next build.
Evidence
With Microsoft Foundry, the experience is this chat’s provider adapter, those fine-tunes and studying for the AI-103, which is in progress; Azure AI Search was studied in depth in that path.
Judgment
What should be done differently today: a citation validator from day one —the model states in a schema which source supports each claim and code checks it— and a judge for the answer calibrated against a sample graded by hand.
Judgment
And it is better not to start with the most sophisticated architecture: start with an index that can be opened and a bank of questions written from the outside; vector search, the reranker or the graph come in when that bank shows what fails.

Block 10

Sources and review date

Reviewed October 18, 2026

[1]
Hybrid search using vectors and full-text search in Azure AI Search
Microsoft Learn · August 31, 2026
https://learn.microsoft.com/en-us/azure/search/hybrid-search-overview
[2]
Semantic ranking in Azure AI Search
Microsoft Learn · August 5, 2026
https://learn.microsoft.com/en-us/azure/search/semantic-search-overview
[3]
Agentic retrieval in Azure AI Search
Microsoft Learn · September 16, 2026
https://learn.microsoft.com/en-us/azure/search/agentic-retrieval-overview
[4]
Introducing Contextual Retrieval
Anthropic · September 19, 2024
https://www.anthropic.com/engineering/contextual-retrieval
[5]
LazyGraphRAG: Setting a new standard for quality and cost
Microsoft Research · November 25, 2024
https://www.microsoft.com/en-us/research/blog/lazygraphrag-setting-a-new-standard-for-quality-and-cost/
[6]
Introducing Citations on the Anthropic API
Anthropic · June 23, 2025
https://claude.com/blog/introducing-citations-api
[7]
Retrieval-Augmented Generation (RAG) evaluators
Microsoft Learn · June 2, 2026
https://learn.microsoft.com/en-us/azure/foundry/concepts/evaluation-evaluators/rag-evaluators
[8]
Introducing Align Evals: Streamlining LLM Application Evaluation
LangChain · July 29, 2025
https://www.langchain.com/blog/introducing-align-evals
[9]
Context Rot: How Increasing Input Tokens Impacts LLM Performance
Chroma · July 14, 2025
https://www.trychroma.com/research/context-rot
[10]
Prompt caching with Azure OpenAI in Microsoft Foundry Models
Microsoft Learn · August 11, 2026
https://learn.microsoft.com/en-us/azure/foundry/openai/how-to/prompt-caching
[11]
Azure API Management policy reference: llm-semantic-cache-lookup
Microsoft Learn · August 18, 2026
https://learn.microsoft.com/en-us/azure/api-management/llm-semantic-cache-lookup-policy
[12]
How to use structured outputs with Azure OpenAI in Microsoft Foundry Models
Microsoft Learn · August 24, 2026
https://learn.microsoft.com/en-us/azure/foundry/openai/how-to/structured-outputs
[13]
LLM08:2025 Vector and Embedding Weaknesses (OWASP Top 10 for LLM Applications 2025)
OWASP GenAI Security Project · November 17, 2024
https://genai.owasp.org/llmrisk/llm082025-vector-and-embedding-weaknesses/
[14]
LLM09:2025 Misinformation (OWASP Top 10 for LLM Applications 2025)
OWASP GenAI Security Project · November 17, 2024
https://genai.owasp.org/llmrisk/llm092025-misinformation/

Summary in three lines

From what is published to an answer that can be checked

Legend of shapes and colors

Reading the map, node by node

Connections

Inputs

Activities

Artifacts

Inputs

Activities

Artifacts

Inputs

Activities

Artifacts

Inputs

Activities

Artifacts

Inputs

Activities

Artifacts

Inputs

Activities

Artifacts

Why the RAG does not use embeddings: lexical, vector or hybrid

Why

Whether to rerank the results

Why

How many sources go into an answer

Why

What the chat does when the question is not its business: the scope threshold

Why

How the chat avoids making up answers: sources that are cited and can be opened

Why

Send everything in the context, or retrieve: when not to use RAG

Why

Prompt caching yes; semantic caching, not in a chat about facts

Why

Hybrid search with semantic reranking

Agentic retrieval: the question is planned before searching

Context added to each passage before indexing it

GraphRAG for questions about the whole dataset

Citations anchored to the exact sentence

Evaluating retrieval and the answer separately, with a judge calibrated against people

Long context does not replace retrieval

Outputs that follow an exact schema

This site’s chat

The index as a quality gate

Two question suites on every change

How many sources and how much each weighs, measured

The layer that adapts the provider, one environment variable

Degradation, tested by a real failure