# Evidence and citations

> How Oyster grounds answers in retrieved passages, what a citation shows, the difference between knowledge and file citations, and what "insufficient evidence" means.

Source: https://documentation.redorca.ai/understand/evidence-and-citations/
Last updated: 2026-11-01

For questions about your files, and in Security Intel, Oyster retrieves the relevant passages first, then answers from them, and shows the sources it used. A citation is not decoration: it is the passage the answer was built on.

## What a citation shows

Click a citation to see:

- the exact passage;
- where it came from — its source, publisher and section;
- a link to the original, where one exists;
- for video, the timestamp of the moment it came from.

## Two kinds of source

- **Knowledge** citations come from Oyster's curated security knowledge base. See [The knowledge base](https://documentation.redorca.ai/understand/knowledge-base/).
- **Project** or **uploaded** citations come from a file you added.

Your files and the curated knowledge are stored separately and do not bleed into each other's results. When an answer deliberately draws on both, each citation is labelled with its kind.

## Insufficient evidence

If retrieval finds nothing relevant, Oyster says the evidence is insufficient rather than inventing an answer. That is the system working correctly. Add a document, rephrase, or accept that the material does not cover the question.

## Citation unavailable

Some sources have a passage but no public link; you can still read the retrieved text. If a citation will not expand, the reference may come from an older index — the answer text is still what the model used.

## Use citations to verify

Read the cited passage before you act on a high-stakes answer. If an answer states a specific fact without a citation, ask Oyster for its source. See [Verify an answer](https://documentation.redorca.ai/guides/verify-an-answer/).