A stricter grounding measure that checks whether a claim is supported by usable excerpts, not just a source reference. It helps distinguish outputs that look sourced from outputs that can be defended. In governance terms, basis coverage is closer to proof than to documentation.
Expanded Definition
Basis coverage is a governance test for whether a statement is actually grounded in evidence that can be inspected and defended. It asks a different question from simple citation: not “was a source named?” but “does the cited material contain enough usable support for the claim being made?” That distinction matters in AI security, compliance reporting, and investigative workflows where a reference can be present without proving the conclusion. For NHI Management Group, basis coverage is best understood as a stricter form of evidentiary completeness, one that reduces the gap between documentation and substantiation.
The concept is especially relevant where generated content, analyst summaries, or automated decisions must survive review. A response may be traceable to a document, but still fail basis coverage if the excerpt is too vague, out of context, or unrelated to the specific assertion. Industry usage is still evolving, so definitions vary across vendors and research communities, but the practical meaning is consistent: evidence must be usable, not merely named. NIST guidance on control evidence and auditability, including NIST SP 800-53 Rev 5 Security and Privacy Controls, supports this kind of defensible traceability.
The most common misapplication is treating a bibliography, citation list, or retrieval log as sufficient basis coverage, which occurs when the source exists but the excerpt does not directly support the claim.
Examples and Use Cases
Implementing basis coverage rigorously often introduces review overhead, requiring organisations to weigh stronger defensibility against slower content production and more manual verification.
- An AI assistant states that a policy permits a control exception, but the quoted policy section only describes the approval workflow, so the claim fails basis coverage.
- A security analyst summarizes a log anomaly and links to the incident record, but the record lacks the timestamps needed to support the stated sequence of events.
- A compliance report cites a control framework and references the right document, yet the excerpt does not contain the specific requirement being asserted.
- An internal knowledge system answers a question with a retrieved source that is relevant at a high level but does not include the passage needed to defend the conclusion.
- A model-generated risk memo uses NIST AI Risk Management Framework style governance language, but the evidence set only supports general oversight, not the specific operational risk claim.
In practice, basis coverage is measured by asking whether a reviewer could reconstruct the conclusion from the cited material without relying on unstated assumptions. That makes it useful for AI-assisted drafting, policy attestation, and incident analysis where traceability must be more than decorative. It also helps teams detect when retrieval systems are returning the right document family but not the right evidence passage.
Why It Matters for Security Teams
Security teams care about basis coverage because unsupported claims create governance exposure even when the source trail looks complete. A report may appear audit-ready, a control may seem documented, or an AI output may look grounded, yet none of that matters if the excerpt cannot bear the weight of the assertion. This is particularly important in AI-enabled security operations, where generated language can be fluent enough to mask weak evidence. Basis coverage gives reviewers a practical way to separate defensible reasoning from merely well-referenced prose.
The concept also fits identity and access governance when attestations, approvals, or exceptions are evaluated. If the record does not show the specific entitlement, approval condition, or policy clause, then the claim remains weak even if the system can point to a related ticket or policy archive. That is why basis coverage supports both compliance review and operational integrity, especially when teams must justify why a control is effective rather than simply present. Related guidance appears across NIST SP 800-53 Rev 5 Security and Privacy Controls and evidence-oriented security governance practices.
Organisations typically encounter the consequences only after a challenged report, failed audit, or disputed AI answer exposes that the cited material never actually proved the claim, at which point basis coverage becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5, NIST AI RMF and NIST SP 800-63 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-01 | Basis coverage supports accountable governance by requiring defensible evidence for claims. |
| NIST SP 800-53 Rev 5 | AU-10 | Auditability depends on records that substantiate statements, not just cite sources. |
| NIST AI RMF | AI RMF stresses traceable, explainable evidence for trustworthy AI outputs. | |
| OWASP Agentic AI Top 10 | Agentic AI controls depend on grounding outputs in usable evidence and context. | |
| NIST SP 800-63 | IAL2 | Identity proofing requires evidence that is sufficient and verifiable, not merely referenced. |
Require evidence that can be reviewed and defended before accepting any security or AI assertion.
