CONSENT CONSOLE/MK-V
DEFAULT

Telemetry consent. Operator-grade.

We capture only the signals we need to keep the site running, understand which content earns reads, and credit referral partners. You decide what stays on. Default is strict opt-in.

Privacy Policy →Terms →
JURISDICTIONOutside regulated jurisdictionsFRAMEWORKNo regional opt-in framework applied

COMPLIANCE FRAMEWORKS RECOGNIZED

GDPREU / EEA
CCPACalifornia
LGPDBrazil
PIPEDACanada
ePrivacyEU Directive
Strategia-X
L
-6dB
C
-1dB
R
-3dB
IT Strategy

Your documentation is a claim nobody audited

Rocky ElsalaymehMay 21, 20265 min read887 words
IT StrategyOP-1623

Your documentation is a claim nobody audited

PUB·5 MIN·887 WORDS

Executives worry about the chatbot that invents a fact. The quieter exposure is the manual that invents a product. It sits on your site, it reads as authoritative, and nobody on your team is assigned to doubt it.

I found that in my own project. Team-X, an open-source, local-first desktop app for running AI-agent organizations, shipped v3.2.0 on 2026-05-11 with what its changelog calls a docs honesty pass. The docs had described a hosted API, a teamx command-line tool, freemium tiers, account signup, and a plugin marketplace. None of it existed. The product is a desktop app with no hosted service of ours in the loop.

What was wrong, in business terms

This was not a stale paragraph. The old developer reference told readers to call a REST API with a Bearer key against a placeholder domain, and its table of contents listed Workspace API, Webhooks, and Plugin Development as sections. One CLI page ran 530 lines for a binary that was never built. The cleanup cut that page from 717 lines to 236.

  • Offers that were never made: credit packages and Free, Basic, Pro, and Enterprise tiers for a product that is free.
  • Integrations that were never built: GitHub, GitLab, Slack, Discord, Jira, and Notion connectors. Today the only route is an MCP server someone writes.
  • Onboarding that never existed: a signup and login flow for an app that has no accounts.

The changelog also records why this was urgent: a docs-sync script was mirroring the pages to a live website, and the site sync would have published roadmap content as shipped product.

Who wrote it

The repo does not say, so I will not claim it. I will say the failure has a familiar shape. A developer guide is expected to have an API section, so one appears. Researchers studying code-generating models reported that "the average percentage of hallucinated packages is at least 5.2% for commercial models and 21.7% for open-source models." That study is about package names in code, not documentation. The mechanism transfers: a plausible name that nobody verified.

Why the exposure is real

Readers act on documentation without a conversation to push back in. Public cases show where that leads. The BC Civil Resolution Tribunal held Air Canada liable after its chatbot gave a passenger bad advice, and BBC reporting quotes the ruling: "It should be obvious to Air Canada that it is responsible for all the information on its website."

In April 2025 a Cursor support bot told a user that being logged out when switching machines was expected behavior under a new policy. Ars Technica put it plainly: "But no such policy existed, and Sam was a bot." The Register quotes the company's own correction: "Unfortunately, this is an incorrect response from a front-line AI support bot."

This is not legal advice. It is a direction of travel: what you publish is treated as what you said. And your buyers already discount machine output. In the 2025 Stack Overflow developer survey, "More developers actively distrust the accuracy of AI tools (46%) than trust it (33%)." Wrong docs spend that trust whether a model wrote them or not.

What the repair looked like

Three moves. First, rebuild each page from a source that can be checked: the restored integration guide was sourced from the API endpoint list, and the changelog states that the upstream app repo is now the source of truth. Second, publish a denial list. The integration guide now has a section titled "What is intentionally not here," which says flatly that there are no native SaaS connectors. Third, grep for leftovers and record the result.

Even the repair needed repair. An early pass hedged an answer so it would not invent button names. The changelog says that softening was wrong. The accurate answer came from reading the code, not from softer prose.

Where it fell short

It did not catch everything. At the v3.2.1 tag, one FAQ line says there is no paid tier and no employee quota. About 130 lines later the same file carries a table headed Employee Quota with Free at 3, Basic at 10, Pro at 25, and Enterprise at 50 or more. My leftover grep was a list of terms, and that table used none of them.

The repo's mechanical claim checker reads one file, CLAUDE.md, and its commit hook skips unless that file is staged. It is a sound gate for what it reads. The user guide had no equivalent.

What an operator should do this quarter

  1. Inventory what republishes your docs. Sync scripts, wikis, and search indexes copy errors at machine speed. Decide which side wins a disagreement.
  2. Audit capability nouns. Grep for API, webhook, SDK, CLI, plan, tier, account, and marketplace. Every hit needs an implementing file or a deletion.
  3. Require an anchor per claim. Each feature sentence points to the path:line that implements it. No anchor, no sentence.
  4. Gate docs like code. Write the Docs describes docs as code as "a philosophy that you should be writing documentation with the same tools as code." Reviews and automated checks belong in that list.
  5. Publish what you do not do. A plain denial list is cheaper than a support queue.

The full account, with the table of what was claimed against what shipped, is in the Team-X post.

-Rocky

#TeamX #Documentation #AIGovernance #EngineeringDreams #StrategiaX

Originally published on Team-X Blog.

Team-X Documentation AI Governance Product Trust Engineering Process Risk Management

/Rocky