INL Reviewing Smarter RFI: Four Readings of “Every Output Traceable”

Date: August 25, 2026 · Author: Dmitrii Zatona  · Updated: September 29, 2026

TL;DR

• Idaho National Laboratory’s operator posted the Reviewing Smarter RFI, INL-26-047, on June 23, 2026; responses closed July 8, and no public follow-on solicitation or award appears as of September 29, 2026 (Section 1).
• The RFI asks for outputs that are fully cited, auditable and traceable to source documents at three levels of the document: its scope, its live-demonstration criteria and its assessment criteria (Section 2).
• The wording fits four properties of increasing strength: a checkable citation, a recorded execution, a reproducible run and a verifiable attestation, which still leaves complete capture, faithful execution and source support unproven; the text selects none (Section 3).
• The citation layers surveyed deliver the first; their records sit in operator-held stores, no surveyed citation schema carries a source revision, and the two model vendors surveyed disclaim deterministic replay (Section 4).
• Licensing corpora run to millions of pages and decades of revisions, and the NRC’s own AI documents treat traceability and explainability as open work (Sections 5 and 6).
• The analysis does not identify the regulator or claim that the RFI requires any particular rung; its negatives are bounded to the documents and dates named (Sections 3 and 8).

Every output traceable to source documents is a line from a request for information that Idaho National Laboratory’s operator posted for AI tools in nuclear licensing review. The document wants reviews that take years shortened by years, for an international regulator it does not name, without losing rigor, explainability, or independent regulatory judgment. Traceability is the property meant to make that trade safe, and the document never says what it means by it.

The phrase matters because each plausible meaning prices out differently: one is a feature products ship today, another has no standardized form for generated text in the transparency-log, attestation, tracing, manifest and citation documents reviewed in Section 8, as of September 29, 2026. This article takes the phrase apart into the operational readings it admits and the engineering problems that sit between them.

1. What was published

The notice is INL-26-047, “*Request for Information* Reviewing Smarter: AI Tools for Building International Nuclear Regulatory Capacity,” posted on SAM.gov  on June 23, 2026 by Battelle Energy Alliance, LLC. BEA is the management and operating contractor that runs Idaho National Laboratory for the Department of Energy under contract DE-AC07-05ID14517 . SAM.gov classifies the posting as a Special Notice; “Request for Information” lives in the title string.

The notice was published twice on the same day. A first version, posted at 14:48 UTC with a July 10 response deadline, was replaced 64 minutes later by the surviving version with a July 8 deadline, and SAM.gov marked the first version’s PDF as deleted at the moment of replacement. The two PDFs differ in size by 215 bytes, the only documented difference between them. Responses were due by email on July 8, 2026, the notice archived automatically the same day, and questions and submissions went to two INL addresses, those of Katya Le Blanc and Chase Egbert.

The document states that it is not a request for proposals and commits the issuing authority to no procurement. It describes itself as input to a potential pilot and deployment pathway, with an anticipated sequence of formal solicitation, scoped pilot and production deployment. As of September 29, 2026, exact-phrase searches of SAM.gov for the notice’s number and title return only the notice itself, and USAspending shows no award traceable to it.

Those searches see less than usual here. An engagement contracted through BEA would be a subcontract under its M&O contract, visible in federal award data only if reported as a subaward. As of September 29, 2026, USAspending lists one subaward report under that contract, a construction subcontract from April 2026. BEA’s own notices, such as INL-24-012 , direct invited offerors to register in a separate INL vendor portal, and a solicitation run through that channel could leave no trace in SAM.gov or USAspending.

This is the second teardown in a series; the previous one, “FBI TSC AI Sources Sought: What ‘Traceable Lineage’ Actually Requires”, examined whether the record-level provenance an FBI notice asks for exists as a standard tool.

2. What the requirement says

The RFI’s purpose section sets the frame. Design certification and combined license reviews have historically taken years, and the initiative aims to compress review, research and drafting timelines by years while keeping the applicant–regulator interface safe, traceable, and defensible. Acceleration, it says, must not come at the expense of rigor, explainability, or independent regulatory judgment; outputs must remain fully cited, auditable, and grounded in source documents so that both sides of the interface can rely on them. The scope of interest lists seven capabilities, and two of them carry the traceability language:

“Automated drafting and generation of review-supporting documentation, with full citation and source traceability”

“Explainable reasoning, with every output traceable to source documents”

The other five cover the rest of a review. Intelligent search and discovery across large repositories of technical, safety, and licensing documentation is retrieval. Understanding and relating requirements, guidance, licensing precedent, and prior regulatory reviews is cross-document linking. Identification of resolved topics, open items, and novel or safety-significant issues for prioritized review is classification and prioritization, technically the heaviest item on the list. The provenance question is sharpest there, because the output that matters is a judgment (this issue is novel, this one is resolved) whose derivation someone will later need to see.

Mapping of national/U.S. licensing bases to IAEA and Western European Nuclear Regulators Association requirements is a crosswalk across four normative corpora: national law, U.S. precedent, IAEA safety requirements and the WENRA reference levels . The crosswalk is itself a derived artifact with provenance of its own. A seventh item leaves room for other capabilities. The drafting item quoted above is retrieval-augmented generation with a citation layer, and every output traceable to source documents is the phrase whose meaning the rest of the analysis turns on.

One distinction has to come before the tooling, because the tooling ships one property and the wording can be read as either. Citation correctness is a relation between an output and a source: the source supports the statement. The attribution literature defines it that way, as output “verified against an independent, provided source” (Rashkin et al., Computational Linguistics 49(4)), and a person with no access to the generating system can check it. Assembly provenance is a relation between an output and a process: these sources, in this form, were what the system used to produce this output.

The two come apart in both directions. A system such as RARR  (ACL 2023) “automatically finds attribution for the output of any text generation model,” after generation, for text the sources played no role in producing, and post-hoc citation is a standard, benchmarked architecture (ALCE , EMNLP 2023). In the other direction, retrieved context that shaped an answer can go uncited. Citation precision and citation recall are separately defined and separately measured (Liu et al. , Findings of EMNLP 2023); a citation mechanism guarantees neither, and neither measures assembly.

The RFI asks for traceability at three levels of the document. The first is the scope item above. The second is the live-demonstration criteria, which include citation and source traceability for every answer, checked in real time on a non-trivial licensing scenario. The third is the assessment criteria, whose second item is traceability and explainability: every output cited and auditable. A property demanded three times, at demonstration and at assessment, is central to how responses would be judged. The text does not say which property it is.

A second thing the text leaves open is who is asking. The document says “the issuing authority” throughout and never equates that phrase with INL, BEA, DOE or any named regulator. The authority is interested in tools that support an international regulator’s licensing review function, and one demonstration criterion is applicability to international partners deploying nuclear energy for the first time.

One section describes down-selected respondents helping to approach potential partners and assess their interest. A later section anticipates a pilot on the regulator’s own documents and production in the regulator’s sovereign cloud tenant, supported through existing bilateral nuclear cooperation frameworks, none of them named. The potential partners of the earlier section and the definite article of the later one sit side by side. Neither the document nor any public source consulted establishes who the regulator is, or whether “the issuing authority” denotes the laboratory, a program office or a partner authority.

3. The assurance ladder

“Traceable to source documents” admits at least four operational readings. Each is a different property, with a different verifier and a different thing that must be trusted.

Rung 1, checkable citation. A reviewer with access to the corpus can open the cited source now and confirm that it supports the statement. The verifier is a human, at review time, inside the system’s trust domain, and what is trusted is the tool’s display and the corpus’s current state. The tool class is the citation layer of grounded-generation products, and products deliver this rung today.

Rung 2, recorded execution. The system retains a record of assembly: which chunks of which documents, which index, which model and which parameters produced the output. The verifier is the operator, plus whoever the operator grants access, and what is trusted is the operator’s store, because its keeper can change the record. The tool class is observability and tracing. This rung exists as raw material, examined in Section 4.2.

Rung 3, reproducibility. The recorded tuple can be re-executed to the same output. The verifier is anyone holding the full execution environment, and what is trusted is environment pinning and deterministic decoding. The vendors surveyed in Section 4.4 offer neither as a contract.

Rung 4, verifiable attestation. A counterparty who does not trust the operator can verify a bounded, signed statement about assembly: that a specific key attested a specific tuple and, where a transparency log participates, that the attestation entered an append-only structure by a point in time. The verifier is any party, adversarially, and what is trusted is cryptographic assumptions plus explicitly stated residual ones. What it leaves unproven is whether capture was complete, whether the process ran as the tuple says, and whether a cited source supports the claim (Section 4.2). The machinery exists, standardized, for certificates, software artifacts and media files; none of the specifications reviewed in Section 4.2 defines a counterpart for generative pipelines.

The RFI’s words are compatible with all four readings. Fully cited reads naturally at rung 1. Auditable is used at every rung, and the word leaves open which store is audited and who keeps it. Defensible is the word that reads furthest up the ladder, given review cycles that run years, corpora that live in revisions for decades, and a two-sided interface between an applicant and a regulator in different jurisdictions. Independent regulatory judgment names the verifier question without answering it.

The text does not select a rung. Each rung up costs more than the last, and the four problems below live in the distance between what rung 1 checks and what rung 4 proves.

4. Four problems between the rungs

The four problems below sit between the rungs. They separate a correct citation from a record of assembly, a record from evidence, a record from the source revisions it depends on, and an archive from a replay.

4.1 Citation correctness is not assembly provenance

The shipping citation layers are documented in detail, and they differ by vendor. Anthropic’s Citations  returns cited text with character or page offsets into the supplied documents. The API extracts the cited text itself, so citations are “guaranteed to contain valid pointers to the provided documents,” while the span selection is model output parsed into that format. AWS Bedrock’s citation objects  carry deterministic offsets locating the cited span in the generated answer, with retrieved-chunk references on the source side.

Google’s grounding metadata  returns byte-offset segments, and its schema carries a per-reference score expressing “confidence that the reference supports the claim.” The schema itself therefore types the link from source to claim as a scored assertion, although the documentation states that the score list is populated for Gemini 2.0 and earlier and empty for Gemini 2.5 and later. Azure OpenAI’s “On Your Data” API  returns no offsets at all. Its answer carries inline [doc1]-style markers that prompt guidance steers, and documents retrieved but not cited can surface under an UNCITED_REFERENCE label (concepts page ).

That last layer also shows the lifecycle of this contract. Microsoft’s documentation states, as of September 29, 2026, that the service will be retired on October 14, 2026. A citation format at this layer is a product surface, and product surfaces change.

None of the four records which context shaped which output tokens, and Azure disables even logprobs when grounding is on. None binds a citation to a revision of the source corpus. The citation edge comes from the same decoding process that produces the prose; three of the four products then extract the cited text deterministically.

The diagram is an inference from the four citation schemas above, not something any vendor documents as one pipeline. The consequence is direct. Rung 1’s check, a reviewer confirming that the cited source supports the sentence, can pass in full on an answer whose assembly is unrecorded, including one whose citations were attached after the fact. Correctness and provenance are independent properties, and verifying the first, at any scale and with any diligence, establishes nothing about the second.

4.2 A record is not evidence

Rung 2 exists as raw material. The OpenTelemetry GenAI semantic conventions , the closest thing to a standard trace schema, define span types for retrieval and tool execution with named attributes. They carry a Development stability status, and nothing in them addresses the integrity of the captured trace. Products record on these shapes and keep the records as workflow assets. The hosted LangSmith  service “retains trace data for 180 days from ingestion” and then deletes it; Bedrock’s invocation logging  is disabled by default, writes to the operator’s own storage and has a delete-configuration API.

The U.S. federal control catalog names the missing properties. In NIST SP 800-53 , AU-9 requires protecting audit information from modification and deletion, and AU-10 requires “irrefutable evidence” of who produced what. Its enhancement AU-10(1) gives the means of determining the producer’s identity to authorized individuals.

Whether an operator-held record is enough depends on who must rely on it. The RFI describes a two-sided interface, with applicant tooling and regulator tooling, and production in a sovereign cloud tenant. It does not say that either side must verify the other’s records; the verifier model is among the things the text leaves open. If the answer is ever a party outside the operator’s trust domain, machinery for bounded, verifiable assertions already exists, and its members differ in ways that matter.

Certificate Transparency (RFC 9162 ) is an append-only Merkle-tree log with inclusion proofs and consistency proofs, and Sigstore’s Rekor  is a transparency log of the same kind for signed supply-chain metadata. The in-toto  framework is signed attestations checked against a layout policy, with no log in the model, and SLSA v1.0  layers build-hardening levels onto such attestations. The C2PA  specification is signed manifests bound to asset bytes, with no append-only log in the model.

Every member proves a statement of the same bounded shape: a key attested a specific tuple and, where a log participates, the attestation was included by a point in time in a history that has not been rewritten. No member proves that capture was complete, that the attested process ran as described, or that a cited source supports anything. A signed retrieval trace, if one existed, would inherit those limits.

The diagram’s right side is one possible verifier model, an inference from the RFI’s two-sided interface, not a requirement the RFI states. What the RFI does state is defensible. Read as engineering, a defensibility claim implies an audience for the defense; the wording leaves open whom that audience includes, and each candidate answer prices out at a different rung.

4.3 No surveyed contract propagates a source change

Licensing corpora live in revisions, on regulated cadences, for decades (Section 5). The retrieval layer’s sync semantics, per the vendors’ own documentation, run forward only. Bedrock re-ingests  changed documents (re-parsed, re-chunked, re-embedded and re-indexed) and removes deleted ones from the vector store, and the console keeps a sync history of the jobs. Azure AI Search detects changes  by timestamp and states that “an indexer doesn’t track object deletion”; its native soft-delete detection is unsupported when blob versioning is enabled. Vertex AI Search refresh  “replaces existing documents with updated documents with the same ID.”

Anthropic’s Files API  is the outlier: “Files cannot be modified or renamed after upload,” so a file id denotes immutable content. No version chain links a replacement file to its predecessor, and the citation object identifies documents by request index and title rather than by file id.

Across the four citation schemas, no citation object carries a revision or timestamp field that a consumer holding a past answer could test against the current corpus. None of the four vendors documents a mechanism that notifies consumers of past answers, or marks them stale, when a source changes. The standards layer can express the event without obliging anyone to emit it. W3C PROV  defines invalidation as “the start of the destruction, cessation, or expiry of an existing entity,” as vocabulary with no emission requirement. OpenLineage’s lifecycle-change  and version  facets are observations attached to runs, and C2PA accretes manifests on the edited asset without reaching derivatives already distributed.

The closest infrastructure is the Delta Sync index in Databricks AI Search  (formerly Vector Search), which keeps an index synced to its source table as the table is updated. That is a freshness contract from source to index, and it stops short of the outputs derived from the index.

The documents checked for this section on August 25, 2026, and again on September 29, 2026, are the Bedrock, Azure AI Search, Vertex AI Search and Anthropic documentation and citation schemas cited above, the OpenTelemetry GenAI conventions, OpenLineage’s dataset facets, W3C PROV, C2PA 2.4, in-toto, SLSA v1.0 and Databricks AI Search. None of them states what a source revision implies for artifacts derived from the prior revision. A literature search on August 25, 2026 found no published work on citation staleness in derived artifacts of this kind, so the finding rests on the specifications rather than on the state of the literature.

The effect is concrete. A draft review section assembled in year two of a licensing proceeding cites a source paragraph superseded in year four. Under 10 CFR 50.71(e) , the underlying safety analysis report is updated at intervals not exceeding 24 months. The stack surveyed here specifies neither which derived artifacts a given revision touches nor who is obliged to find out.

4.4 An archive is not a replay

At rung 3, auditable means the run can be reconstructed. Two obstacles stand, one of policy and one of mechanism. On policy, the seed feature documented in OpenAI’s cookbook  is best-effort (“Determinism is not guaranteed”) and depends on a backend fingerprint the caller can observe but not pin. According to Anthropic’s API reference , results “will not be fully deterministic” even at temperature zero, and models released after Claude Opus 4.6 reject any temperature other than the default 1.0, so greedy decoding cannot even be requested there.

On mechanism, floating-point addition is not associative, and parallel GPU execution does not fix a reduction order. The resulting run-to-run variability in deep-learning inference is documented in the HPC literature (Shanmugavelu et al., SC’24 Workshops ), and no surveyed system records the reduction order in its evidence bundle. Archiving the tuple of prompt, chunks, model id and parameters therefore yields an archive, and an archive is not a replay contract.

One middle case belongs on the ladder. WORM storage such as S3 Object Lock  in compliance mode, where a locked object version “can’t be overwritten or deleted by any user, including the root user,” lets an operator bind its own hands and gives an auditor a configuration to inspect. It exports no proof: the verifier still trusts the storage provider and the capture pipeline in front of it. That hardens rung 2 without reaching rung 4.

The strongest machinery nearby is confidential-computing inference. Microsoft described Azure AI Confidential Inferencing  as an upcoming preview in September 2024: inference in GPU trusted execution environments, with the software artifacts that can see prompts recorded on a transparency ledger and GPU attestation from NVIDIA . It attests which software served the answer. It does not attest which corpus revision and chunks assembled it, and for the assembly of a specific answer the documentation surveyed here offers nothing equivalent.

5. Scale

The corpora these tools would work over are documented in agency numbers. NuScale’s design was the first small modular reactor design the NRC reviewed, per its certification rule  (88 FR 3287). The Department of Energy’s announcement  states that “The 12,000-page application took less than 42 months to review,” with more than two million pages of additional documents for audits. NuScale’s docketed lessons-learned letter  counts “over a quarter million review hours, about two million pages of documentation,” about 100 gigabytes of test data and some 40 meetings of the Advisory Committee on Reactor Safeguards.

The rule traces the application from Revision 0 (December 2016) through a partial Revision 4.1 (June 2020) to the certified Revision 5 (July 2020). The AP1000 certified design moved from Revision 15 (2006) to Revision 19 (2011) through one amendment (76 FR 82079 ). On the regulator’s side, the NRC’s public ADAMS  library holds “more than 3 million full-text documents” released since November 1999 and adds several hundred a day. ADAMS accession numbers serve as document identifiers in the incorporation-by-reference text of the CFR’s design-certification appendices.

Statute and executive order are shortening the clock. Section 207 of the ADVANCE Act  sets 18 months to a safety evaluation and environmental statement and 25 months to a final combined-license decision for qualifying applications, “to the maximum extent practicable.” Executive Order 14300  directs the NRC to set a deadline of no more than 18 months for final decisions on new-reactor applications.

These figures support one operational point and no more. Any assurance procedure that relies on humans re-verifying citations one at a time operates against corpora measured in millions of pages, revision histories measured in years and obligations measured in decades, on a clock that legislation is shortening. The figures establish no error rate and no cost, and the analysis makes no such calculation.

6. What has been tried

Two related but distinct artifacts define the current state of AI for licensing at the national laboratories, and the primary record keeps them apart. The first is a demonstration. On March 26, 2026, DOE announced  that Everstar’s Gordian platform, built on Microsoft Azure and working with INL and Argonne, converted the preliminary documented safety analysis for NRIC’s generic high-temperature gas reactor into sections equivalent to an NRC license application. “The final 208-page document took one day to generate,” against a stated four to six weeks for a team working manually. The announcement reports that expert review found quality and rigor in the output and publishes no quantitative rubric.

The antecedent INL–Microsoft collaboration  (July 2025), funded by DOE’s Office of Nuclear Energy through the National Reactor Innovation Center, states the scope of this class of tool. The tool performs no analyses on the documents; it “automates the process of constructing licensing documents for subsequent human verification.”

The second artifact is an evaluation methodology. The NRIC report INL/RPT-25-87369  (March 2026) is the source of a 50-percent figure: its abstract says the approach “has the potential to reduce both document development time and regulatory review cycles” by as much as half. The report proposes the measurement rather than reporting one, with SME checklist scoring against a DOE-approved benchmark safety analysis followed by a DOE mock review. The tool it evaluates is Microsoft’s generative-AI permitting accelerator rather than Gordian. As published, the potential is a projection with a defined test plan behind it.

On the regulator’s side, the NRC’s AI use-case inventory  lists a deployed text-retrieval-and-generation tool supporting licensing and oversight work. The agency’s FY26 AI strategic plan  states that it “leverages quality, traceable datasets (e.g., ADAMS, EDW) but seeks greater centralization and traceability.” The NRC-commissioned regulatory gap assessment  (October 2024) reads the existing framework as one that “calls for control of information as well as auditability, but not explicit explainability.” The properties in the RFI’s wording (auditability, traceability, explainability) appear in the NRC’s own current documents as open work items rather than settled expectations.

7. Who would build it

The RFI’s mandatory eligibility criteria describe the respondent pool it intends. All five must be met, and the first two set the experience bar:

“Demonstrated, deployed experience applying AI specifically to nuclear energy, licensing, compliance, or safety documentation (commercial, national laboratory, or regulatory deployments). Academic or purely conceptual claims do not satisfy this criterion.”

“Tool has been developed, validated, deployed, or otherwise substantively engaged with the U.S. Department of Energy (DOE) and/or U.S. Nuclear Regulatory Commission (NRC), or a U.S. national laboratory operating under DOE/NRC frameworks. Respondents must describe the nature and current status of that engagement.”

The other three require demonstrated applicability across reactor types from micro to large, the ability to deploy within an international sovereign cloud tenant or otherwise meet the issuing authority’s data residency, security and confidentiality requirements, and availability for a live demonstration within the RFI period. Together the criteria select for vendors already deployed in nuclear documentation work under DOE- or NRC-adjacent frameworks.

The public record names the participants in the work described in Section 6, Everstar and Microsoft with INL and Argonne, in DOE’s own announcements. Participation in that work is all the record establishes. It does not establish that any named vendor meets the five criteria, and no agency publication reviewed here addresses several of them: reactor-class coverage, sovereign-cloud deployment and demonstration availability. The public record does not show whether the anticipated down-select occurred, or with whom; per Section 1, a subcontracting process under BEA could leave no trace in the databases searched.

8. What does not exist as a standard

The table below sets each reading of “traceable” against the closest existing tooling and what that tooling lacks.

Every row exists somewhere, and in the tooling surveyed here no row is complete for this use. In the documents reviewed here (RFC 9162, the Rekor documentation, in-toto and the OpenTelemetry GenAI conventions at the commits linked in Section 4.2, SLSA v1.0, C2PA 2.4, and the Anthropic, Bedrock, Google and Azure citation schemas, as of September 29, 2026), none defines a signed attestation over the assembly tuple of a generated answer: its chunks, their corpus revision, the index, the model and the parameters.

The record-keeping obligations such machinery would serve are already codified in the corpora the RFI’s scope names: U.S. licensing bases, IAEA requirements and WENRA reference levels. U.S. quality-assurance records must be “identifiable and retrievable” (10 CFR 50 Appendix B , Criterion XVII). Licensees must keep “adequate safeguards against tampering with, and loss of records” (10 CFR 50.71(d)), and departures from a certified design must stay “available for audit until the date of termination of the license” (10 CFR 52.63(b)(2) ). The IAEA’s management-system requirements make records “readable, complete, identifiable and easily retrievable” (GSR Part 2 ), WENRA’s reference levels track the same wording, and GSR Part 1  obliges the regulator itself to record formally the basis of its decisions.

The documents do not establish which of these frameworks would govern the unidentified regulator; they are cited as the corpora the RFI’s scope names, not as that regulator’s governing law. In every instrument reviewed, the verification model named in the text is institutional: officer certification, approval levels, regulator audit. None of those instruments specifies how a party outside that institutional relationship verifies record integrity, and that seam is where the ladder’s upper rungs would attach.

The RFI’s own demonstration criteria name applicability to partners deploying nuclear energy for the first time, regulators that the IAEA’s milestones  guidance describes as building review capacity while their programs advance. In that setting, the question of what a regulator can independently verify reads less like a corner case of the wording than like its center.

This analysis does not identify the regulator, does not claim that the RFI requires any rung, and does not claim that the tools surveyed are the only ones; its negatives are bounded to the documents and dates named above. I work on verifiable provenance for generated outputs, and that work is separate from this analysis. More write-ups are on the engineering blog.

If a retrieval or drafting system has to show which source revisions and chunks produced each answer, in a form a reviewer outside the operator can check, building that record is contract work I take on.