Enterprise Document Intelligence Vol.1 #7quinquies argues that most RAG hallucinations stem from retrieval failures, not model invention. Retrieval decides what the model can invent because it decides what the model sees. When teams log LLM hallucinations, they often blame generation, but the model simply answers faithfully from context retrieval should never have provided.

A measurement on the NIST Cybersecurity Framework (55 pages) demonstrates this: the question "what backup practices keep data available after a ransomware attack?" has its answer in subcategory PR.IP-4 on page 41. Using naive cosine similarity, the correct page ranks 55th of 55—dead last—while Data Security (PR.DS) ranks first. A simple keyword count, however, places the answer at rank 1. The model handed the wrong pages invents plausible but unsupported answers, which reviewers log as hallucinations.

Three retrieval conditions cause this: (1) the answer was not retrieved, forcing the model to fill gaps from parameters; (2) the wrong passage was retrieved—near-miss controls that sound right but address different concerns; (3) the answer was buried in distractors, where extra context adds noise. All three leave the generation brick blameless; the lever is upstream. Cosine similarity ranks by surface meaning, a poor proxy for answer location.