Government and Institutional Source Verification Prompt

This prompt is designed for compliance engineers, trust-and-safety architects, and RAG pipeline builders who need to verify that a source is an official government, regulatory body, or institutional publication before it is used as evidence. The job-to-be-done is not general fact-checking or content moderation—it is a targeted verification step that answers one question: 'Is this source what it claims to be, and is it current enough to trust?' The ideal user is someone integrating this check into an automated evidence pipeline where downstream answers, audit trails, or regulatory submissions depend on source authenticity.

Use this prompt when your system retrieves documents that claim to be from .gov domains, regulatory agencies, international bodies, or official institutional publishers. It is appropriate for compliance workflows in finance, healthcare, legal, and government-adjacent products where citing an impersonator or outdated guidance carries real consequences. The prompt expects structured input: a source URL, claimed publisher name, document title, publication date, and the full text or a representative excerpt. It returns a structured verdict with an authenticity tier, recency assessment, impersonation risk flags, and an evidence trail explaining each signal used in the decision. Do not use this prompt for general web page credibility scoring, social media content, or sources where official institutional status is not the primary concern—other playbooks in the Source Trustworthiness and Authority Assessment group handle those cases.

This prompt is not a replacement for human review in high-stakes decisions. When the authenticity tier is 'Uncertain' or the impersonation risk is elevated, the output should trigger a human-in-the-loop review step, not automatic acceptance or rejection. The prompt also does not verify the factual accuracy of the document's content—it only verifies the source's claimed identity and currency. Pair it with the Fact Checking and Claims Verification prompts if you need to validate statements within the document. Before deploying, test against known impersonation cases, outdated guidance republications, and legitimate institutional sources to calibrate your risk thresholds.

This prompt template is designed to be copied directly into your prompt management system, IDE, or orchestration layer. It accepts a source document or URL along with configurable constraints and returns a structured verification assessment. The template uses square-bracket placeholders that you replace with your application's specific inputs, risk thresholds, and output format requirements before sending the request to the model.

textCopy
You are a source verification specialist trained to identify official government, regulatory, and institutional publications. Your task is to determine whether the provided source is an authentic, current, and authoritative publication from an official government body, regulatory agency, or recognized institutional publisher.

## INPUT
Source content or metadata to evaluate:
[SOURCE_CONTENT]

## CONSTRAINTS
- Risk tolerance level: [RISK_LEVEL: low | medium | high]
- Required authority threshold: [AUTHORITY_THRESHOLD: official_only | official_preferred | any_credible]
- Domain context (e.g., healthcare, finance, environmental): [DOMAIN]
- Jurisdiction scope (e.g., US federal, EU, global): [JURISDICTION]
- Maximum acceptable content age in months: [MAX_AGE_MONTHS]

## VERIFICATION CRITERIA
Evaluate the source against each criterion below. For each, provide a finding, confidence score (0.0-1.0), and specific evidence from the source.

1. **Official Domain and URL Structure**: Does the source originate from a .gov, .mil, .europa.eu, or equivalent official top-level domain? For institutional sources, does the URL match the organization's known official web presence?
2. **Publisher Identity Verification**: Is the publishing entity a verifiable government agency, regulatory body, or chartered institution? Cross-reference against known official entity names for [JURISDICTION].
3. **Document Type Classification**: Is this a primary official document (statute, regulation, official guidance, regulatory filing, official report) or a secondary reproduction, commentary, or summary?
4. **Impersonation Detection**: Are there signs that this source is impersonating an official entity? Check for lookalike domains, unofficial logos, missing official disclaimers, or unauthorized use of government seals.
5. **Recency and Version Status**: Is the publication date within [MAX_AGE_MONTHS] months? If undated, flag as high risk. Check for indicators that this version has been superseded, withdrawn, or replaced.
6. **Content Authenticity Markers**: Does the document contain expected official markers such as document control numbers, official letterhead, authorized signatories, publication references, or digital signatures?
7. **Unofficial Republication Detection**: Is this content copied or reproduced from an official source by a third party? Check for missing original context, added commentary, or altered formatting that could change meaning.

## OUTPUT SCHEMA
Return a JSON object with this exact structure:
{
  "verification_result": "verified_official" | "likely_official" | "uncertain" | "likely_unofficial" | "confirmed_unofficial",
  "confidence_score": 0.0-1.0,
  "source_identity": {
    "claimed_entity": "string",
    "verified_entity": "string or null",
    "entity_type": "government_agency" | "regulatory_body" | "institution" | "unknown" | "impersonator"
  },
  "criteria_assessment": [
    {
      "criterion": "string",
      "finding": "pass" | "fail" | "inconclusive",
      "confidence": 0.0-1.0,
      "evidence": "specific quote or observation from source"
    }
  ],
  "risk_flags": ["string"],
  "recommended_action": "use_directly" | "use_with_caution" | "verify_further" | "reject" | "escalate_for_human_review",
  "explanation": "Concise summary of the verification reasoning suitable for audit logs."
}

## INSTRUCTIONS
- If any single criterion produces a critical failure (confidence < 0.3 on a high-severity check), set recommended_action to "reject" or "escalate_for_human_review" based on [RISK_LEVEL].
- For [RISK_LEVEL: high], any uncertainty must escalate for human review.
- Do not infer official status from content quality alone. A well-written document on an unofficial site is still unofficial.
- If the source is a third-party reproduction of official content, flag it as "likely_unofficial" regardless of content accuracy.
- Cite specific evidence for every criterion assessment. Do not use vague language like "appears legitimate."

To adapt this template for your application, replace each square-bracket placeholder with values from your runtime context. The [SOURCE_CONTENT] placeholder accepts raw text, a URL, or structured metadata depending on your pipeline. For batch processing, wrap this prompt in a loop that populates placeholders per source. The output schema is designed for direct parsing into a verification database; add fields as needed for your compliance requirements. If your use case involves regulated domains such as healthcare or finance, set [RISK_LEVEL] to high and ensure the escalate_for_human_review action triggers a notification to your compliance team before any downstream use of the source.

Before deploying, test this prompt against a golden dataset containing known official sources, known impersonation attempts, outdated guidance, and third-party republications. Validate that the JSON output parses correctly and that recommended_action aligns with your organization's risk policy. For high-risk workflows, implement a secondary verification step: if confidence_score falls below 0.8 or verification_result is uncertain, route the source to a human reviewer and log the full criteria assessment for audit purposes.

This prompt is designed to operate as a pre-retrieval or post-retrieval gate in a RAG pipeline, not as a standalone chat interaction. The most common integration pattern is to call it after document retrieval but before evidence is passed to an answer-generation prompt. When a retrieved source fails verification, the system should either discard it, downgrade its weight in downstream ranking, or flag it for human review depending on the [RISK_LEVEL] configured. For compliance workflows, the output should be logged immutably alongside the source metadata to create an audit trail showing that every cited document passed institutional verification checks.

Validation layer: Parse the model's JSON output and validate that source_type matches one of the allowed enum values (official_government, regulatory_body, institutional_publication, unofficial_republication, impersonation_risk, unknown). Reject any response where confidence_score is outside the 0.0–1.0 range or where verification_indicators is empty. If the model returns malformed JSON, use a repair prompt that feeds the raw output and the expected schema back to the model with a strict instruction to fix parse errors. After two repair attempts, escalate to a human review queue with the original source content and metadata attached.

Retry and fallback strategy: For transient model failures (timeouts, rate limits, 5xx errors), implement exponential backoff with a maximum of three retries. For persistent failures, fall back to a heuristic check: verify the domain against a maintained allowlist of known government and institutional domains (.gov, .edu, .who.int, etc.) and flag any source that fails both the model check and the domain allowlist. Do not silently pass unverified sources downstream. Logging: Record the prompt version, model ID, input source URL, verification result, confidence score, and timestamp for every call. This log becomes essential evidence if a compliance auditor questions why a particular source was used or excluded.

Model selection: Use a model with strong instruction-following and JSON output capabilities. GPT-4o, Claude 3.5 Sonnet, and Gemini 1.5 Pro all perform well on this structured classification task. Avoid smaller models (under 7B parameters) for this prompt unless you have fine-tuned them specifically on government document classification and validated their impersonation detection accuracy. Human review integration: When source_type returns impersonation_risk or confidence_score falls below your threshold (recommend 0.85 for regulated use cases), route the source to a review queue. The review interface should display the original source URL, the model's verification indicators, and a one-click action to approve or reject the source. Track reviewer decisions to build a dataset for future model improvement.

What to avoid: Do not use this prompt as the sole verification step in high-stakes compliance workflows. Always combine it with domain allowlisting, TLS certificate validation for the source host, and periodic human audits of verification decisions. Do not cache verification results indefinitely—government pages change, domains expire, and impersonation sites evolve. Set a maximum cache TTL of 24 hours for verified sources and re-verify on every retrieval for sources flagged as unofficial_republication. Finally, ensure your logging system captures the full prompt and response for every verification call; this trace data is invaluable when debugging false positives or investigating why a compromised source passed verification.