Independent Multi-Source Corroboration Governance requires that AI agents corroborate critical data inputs, intermediate calculations, and action parameters against independent sources before executing high-consequence actions. The principle is simple: no single data source, no single calculation, and no single reasoning chain should be sufficient to trigger an action whose consequences are material. The agent must obtain confirming evidence from at least one independent source — a source that does not share the same data pipeline, the same calculation engine, or the same failure modes as the primary source. This dimension addresses the class of authorised-but-wrong errors that originate from a single point of data failure: a stale API response, a corrupted database record, a miscalculated intermediate value, or a hallucinated fact that the agent treats as ground truth. By requiring independent corroboration, AG-146 ensures that the probability of executing a wrong action requires simultaneous failure of multiple independent sources — a categorically less likely event than failure of a single source.
Scenario A — Single-Source Price Data Causes Trading Loss: A financial-value agent is authorised to execute foreign exchange trades to hedge the organisation's USD exposure. The agent queries its primary FX rate provider and receives a GBP/USD rate of 1.2540. Based on this rate, it executes a £2,000,000 hedge trade. The rate was stale — the provider's API had cached a rate from 47 minutes earlier. The live market rate at execution was 1.2380, a 1.28% difference. The trade executes at a rate that is 160 pips away from the market, resulting in an immediate mark-to-market loss of £25,600 and an execution that does not achieve the intended hedge ratio.
What went wrong: The agent relied on a single rate source. No corroboration against an independent FX rate provider was performed. A second source would have returned a rate near 1.2380, flagging a 160-pip discrepancy that exceeds any reasonable tolerance. Consequence: £25,600 immediate loss, hedge ratio deviation, potential regulatory scrutiny for best execution failure.
Scenario B — Hallucinated Drug Interaction Leads to Clinical Error: A clinical decision support agent is queried about drug interactions for a patient taking warfarin who needs pain management. The agent generates a response stating that celecoxib has "no clinically significant interaction with warfarin" and recommends it at 200mg twice daily. This is factually incorrect — celecoxib increases the anticoagulant effect of warfarin and increases bleeding risk. The agent hallucinated the interaction profile. The prescribing clinician, trusting the agent's output, prescribes celecoxib. The patient develops gastrointestinal bleeding requiring hospitalisation.
What went wrong: The agent's response was not corroborated against an independent drug interaction database (e.g., BNF, Stockley's, or a structured interaction API). A single query to any of these sources would have returned a "significant interaction — increased bleeding risk" result. Consequence: Patient harm, hospitalisation, clinical negligence claim, regulatory investigation.
Scenario C — Corrupted Inventory Data Triggers Over-Ordering: An enterprise workflow agent manages inventory replenishment for a retail chain. It queries the inventory management system, which reports that warehouse stock of product SKU-7742 is 12 units against a reorder threshold of 500 units. The agent places a replenishment order for 2,000 units at £47 each (£94,000). In reality, the inventory system had a data corruption issue — actual stock was 4,800 units, well above the reorder threshold. The corrupted record showed 12 units. The excess order of 2,000 units creates £94,000 in unnecessary inventory and a storage cost problem.
What went wrong: The agent relied on a single inventory data source. Corroboration against a secondary source — a warehouse management system, recent receipt records, or a physical count validation — would have revealed the discrepancy between 12 units and the expected stock level based on recent deliveries and sales. Consequence: £94,000 in excess inventory, storage costs, cash flow impact, write-down risk if the product is perishable or seasonal.
Scope: This dimension applies to all AI agents that make decisions or execute actions based on data from external sources (APIs, databases, web services, sensor readings, document extraction) where the consequences of acting on incorrect data are material. Material consequences include financial loss exceeding a defined threshold, patient or public safety impact, regulatory compliance violation, data integrity compromise, or operational disruption. The scope specifically includes actions where the agent uses its own generated knowledge (reasoning, calculation, or factual recall) as a basis for action — these outputs must be corroborated against authoritative external sources because they are subject to hallucination, calculation error, and reasoning failure. Read-only informational responses with no downstream action consequences may be excluded from mandatory corroboration but should still indicate the confidence level and source provenance of the information.
4.1. A conforming system MUST corroborate critical data inputs against at least one independent source before executing any action whose consequence exceeds a defined materiality threshold, where "independent" means the corroborating source does not share the same data pipeline, storage system, or upstream provider as the primary source.
4.2. A conforming system MUST define materiality thresholds per action type that determine which actions require corroboration. The threshold MUST be configurable and MUST default to requiring corroboration for all irreversible actions (as classified by AG-143).
4.3. A conforming system MUST define acceptable divergence tolerances per data type — the maximum permissible difference between the primary source and the corroborating source that allows the action to proceed without escalation. For example: FX rates within 50 basis points, inventory counts within 5%, dosage calculations within 2%.
4.4. A conforming system MUST block or escalate actions where the primary source and the corroborating source diverge beyond the acceptable tolerance, presenting both values to a human reviewer.
4.5. A conforming system MUST corroborate agent-generated factual claims (including calculations, drug interaction assessments, legal interpretations, and technical specifications) against authoritative reference sources before these claims are used as the basis for action.
4.6. A conforming system MUST log all corroboration checks, including the primary value, the corroborating value, the divergence, the tolerance threshold, and the outcome (proceed, escalate, reject).
4.7. A conforming system SHOULD implement source independence validation that verifies the corroborating source is genuinely independent — not a mirror, cache, or downstream consumer of the primary source.
4.8. A conforming system SHOULD implement graduated corroboration requirements: single-source for low-value reversible actions, dual-source for moderate-value or partially reversible actions, and triple-source for high-value irreversible actions.
4.9. A conforming system MAY implement consensus-based corroboration for critical actions, where the action proceeds only if a majority of N independent sources agree within tolerance (e.g., 3 of 5 FX rate providers must agree within 20 basis points).
The fundamental vulnerability AG-146 addresses is single-point-of-data-failure. An AI agent making a decision based on one data source inherits all the failure modes of that source: staleness, corruption, manipulation, hallucination, and error. The agent cannot distinguish between correct data and incorrect data from the same source — data arrives through the same channel, in the same format, with the same apparent authority. Only by querying an independent source can the agent (or, more precisely, the governance infrastructure) detect a discrepancy that indicates one source may be wrong.
This principle is well-established in safety-critical engineering. Avionics systems use triple modular redundancy — three independent computers processing the same inputs, with a voting mechanism that detects and isolates faulty outputs. Nuclear reactor control systems use diverse redundancy — different hardware, different software, different teams — to ensure that a single design flaw does not compromise all channels simultaneously. AG-146 applies the same principle to AI agent data inputs: independent corroboration provides redundancy against single-source failure.
The principle is equally important for agent-generated content. When an AI agent generates a factual claim — a drug interaction profile, a legal interpretation, a technical specification, a financial calculation — it is, in effect, consulting a single source: its own model. That model is subject to hallucination, training data errors, and reasoning failures. Corroborating agent-generated claims against authoritative external sources provides the same independent verification as corroborating external data against a second external source.
The divergence tolerance is a critical design parameter. Setting it too tight generates excessive false positives (legitimate minor differences between sources trigger unnecessary escalations). Setting it too loose allows material errors to pass undetected. The tolerance should reflect the operational significance of the data: FX rates are highly sensitive (50 basis points on a £2M trade is £10,000), while inventory counts for low-value items may tolerate wider variance.
AG-146 requires a corroboration engine that intercepts agent data lookups and action submissions, queries independent sources, and validates agreement before allowing execution to proceed.
Recommended patterns:
Anti-patterns to avoid:
Financial Services. FX rate corroboration should use genuinely independent providers — not two terminals querying the same interbank feed. Trade execution parameters (price, quantity, venue) should be corroborated against independent market data. For valuation purposes, firms should implement the principle of "independent price verification" already required by prudential regulations, extending it to AI agent inputs.
Healthcare. Drug interaction claims, dosage calculations, and clinical guideline interpretations must be corroborated against authoritative structured databases. Agent-generated clinical recommendations should never be the sole basis for prescribing decisions — corroboration against BNF, NICE guidelines, or equivalent is mandatory. Diagnostic suggestions should be corroborated against differential diagnosis databases.
Legal and Compliance. Legal interpretations, regulatory citations, and contract clause analysis must be corroborated against authoritative legal databases. AI agents are known to hallucinate case citations — independent verification against a legal database is essential before any legal claim is relied upon for action.
Basic Implementation — The organisation has defined materiality thresholds and requires dual-source corroboration for actions above the threshold. Acceptable divergence tolerances are defined per data type. Corroboration failures block execution. Corroboration checks are logged. This level meets the minimum mandatory requirements but uses a single corroboration model (dual-source) without graduated tiers or source independence validation.
Intermediate Implementation — Graduated corroboration tiers (dual-source and triple-source) based on action consequence. Source independence registry validates that corroborating sources are genuinely independent. Agent-generated factual claims are corroborated against authoritative reference sources. Divergence patterns are analysed to identify recurring data quality issues and tune tolerances.
Advanced Implementation — All intermediate capabilities plus: consensus-based corroboration with voting for critical actions. Real-time source independence monitoring detects when previously independent sources become correlated (e.g., due to provider consolidation). Machine learning models predict which data inputs are most likely to be erroneous and apply enhanced corroboration. Adversarial testing has verified resistance to source poisoning, coordinated data manipulation, and corroboration bypass attempts.
Required artefacts:
Retention requirements:
Access requirements:
Test 8.1: Divergence Detection Within Tolerance
Test 8.2: Divergence Detection Beyond Tolerance
Test 8.3: Source Independence Validation
Test 8.4: Agent-Generated Claim Corroboration
Test 8.5: Corroboration Source Unavailability
Test 8.6: Graduated Corroboration Tier Enforcement
| Regulation | Provision | Relationship Type |
|---|---|---|
| EU AI Act | Article 9 (Risk Management System) | Direct requirement |
| EU AI Act | Article 10 (Data and Data Governance) | Direct requirement |
| EU AI Act | Article 15 (Accuracy, Robustness and Cybersecurity) | Direct requirement |
| FCA SYSC | 6.1.1R (Systems and Controls) | Direct requirement |
| MiFID II | Article 27 (Best Execution) | Supports compliance |
| Basel III/CRR | Article 105 (Prudent Valuation) | Supports compliance |
| NIST AI RMF | MAP 2.3, MANAGE 2.2 | Supports compliance |
| ISO 42001 | Clause 6.1, Clause 8.2 | Supports compliance |
Article 10 requires that training, validation, and testing data sets be relevant, representative, free of errors, and complete. While AG-146 addresses runtime data rather than training data, the principle extends: the data on which an AI system bases its actions must be accurate and verified. Runtime corroboration is a direct implementation of the data quality principle applied to operational data inputs. The Article's requirement for "appropriate data governance and management practices" supports mandatory corroboration as a data quality control.
Article 15 requires that high-risk AI systems achieve an appropriate level of accuracy, robustness, and cybersecurity. Independent corroboration directly supports accuracy (detecting incorrect data before it influences actions) and robustness (ensuring the system does not fail due to single-source data errors). Cybersecurity is supported by corroboration's resistance to single-source data manipulation attacks.
Article 105 requires institutions to apply prudent valuation to fair-valued positions, including the use of independent price verification. AG-146's corroboration requirement extends this principle to all AI agent data inputs in financial services, not just valuation data. The regulatory precedent for independent verification of financial data is well-established; AG-146 generalises it to all agent-consumed data.
Best execution requires firms to take all sufficient steps to obtain the best possible result. For AI agents executing trades, relying on a single price source creates the risk of executing at a stale or manipulated price. Corroboration against independent price sources supports best execution by ensuring the execution price reflects the current market.
| Field | Value |
|---|---|
| Severity Rating | High |
| Blast Radius | Variable — single-action for isolated data errors; potentially organisation-wide for systematic data source failures |
Consequence chain: Without independent corroboration, an AI agent acts on data from a single source with full confidence regardless of whether the data is correct. A stale API response, a corrupted database record, a hallucinated factual claim, or a manipulated data feed will be treated as authoritative. The immediate consequence is an action based on incorrect data — a trade at the wrong price, a clinical recommendation based on a false interaction profile, a replenishment order based on corrupted inventory data. The financial impact is the cost of the error: for the FX trade example, £25,600 in immediate loss; for the inventory example, £94,000 in excess stock; for the clinical example, the cost of patient harm and litigation. The systemic risk is compounded when the same incorrect data source influences multiple agent actions — a stale FX rate affecting dozens of trades, a corrupted database record affecting all queries referencing that record. The regulatory consequence is the inability to demonstrate adequate data quality controls, which is a finding under the EU AI Act (Article 10), financial regulations (Basel III prudent valuation), and healthcare regulations (duty of care). Cross-reference: AG-001 (mandate enforcement), AG-096 (tool output validation provides first-line data quality checking), AG-143 (cooling-off provides time for corroboration), AG-145 (target verification is a specific form of corroboration for target identity), AG-147 (post-actuation reconciliation catches corroboration failures after execution).