Grounding by construction: never let the model write the table

Marja Intelligence answers market research questions in Persian over a corpus of 15,913 companies. Its users act on the output: they call these companies. A hallucinated phone number isn't a funny screenshot, it's a broken product.

So the rule was structural. The LLM picks tools and criteria. The server runs SQL and builds every result table itself, and the model never has a chance to write a row.

What that looks like

1. A small set of typed tools, five in this case, each mapped to a real query.
2. Tables returned as structured blocks in the API contract, not as text in the reply.
3. The conversational text wraps the table, but can't change what's inside it.
4. A golden suite of end-to-end questions that has to pass before a model or prompt change ships.

This also makes model upgrades boring, which is what you want. A new model is a config change and a gate re-run. The worst it can do is pick a worse query, and the golden suite catches that.

"Unlikely to hallucinate" is a hope. "Has no way to write that field" is a design.