The scariest failure mode in generated marketing copy isn't bad grammar. It's a confident, specific, wrong number. "43% faster onboarding" reads great right up until someone asks where it came from.
So we made a rule early and enforced it in code, not in a prompt: every statistic and multi-digit number in produced copy must trace back to the facts and KPIs the brand actually supplied. Not "should." Must. A verification pass runs over the drafted copy, matches each figure against the source material, and records the result. Two claims entering that pass can leave with very different paperwork:
What happens when a number doesn't match
The tempting design is to block: refuse to ship anything with an unverified claim. We tried it, and it turns a pipeline into a tantrum. One ambiguous figure and the whole campaign stalls.
Our gates flag and annotate instead. An unverified statistic is written to the audit trail with a severity, attached to the asset, and surfaced for review — but the run keeps moving. The failure is isolated to the claim, not inflated into a dead pipeline. A human holds the last gate before publication, so nothing with an open flag ships on a model's say-so. That division of labor is the whole point: machines are relentless about checking, humans are good at judging.
The receipt itself
Every asset ships with a manifest written at render time: the objective, the channel, a hash of the content spec, and lineage back to the source documents each claim came from. When someone asks "where did this figure come from" six months later, the answer is a file, not a memory. Re-render the same spec and you get the same asset — which makes the run record worth something.
Why this is an engineering note, not a promise
Wishes don't survive contact with a temperature setting.
Prompt-level instructions ("do not invent statistics") are a wish. Validation that runs after authoring, on the actual output, with results logged per claim — that survives. It's the same reason the brand-safety checks (banned terms, absolute claims, missing disclaimers) run as deterministic scans rather than model self-critique.
We're still pre-launch, and this layer is one reason why. It's easier to demo a generator than to build the part that tells you when the generator is wrong. But the second part is the one an enterprise team actually needs.