RAG Evaluation Checklist: 20 Tests for Grounded Answers

What a RAG evaluation must isolate

Corpus eligibility comes before semantic similarity

A passage can be relevant but ineligible because it belongs to another tenant, is superseded, is outside the user's role, lacks an owner or has passed its review date. The evaluation manifest should decide eligibility before ranking. A strong similarity score cannot repair a failed authorization or version decision.

Parsing determines what retrieval can see

PDF columns, table headers, merged cells, footnotes, image captions and section hierarchy may be lost before embedding or search. Preserve a reference rendering and the normalized extraction. When a correct fact never enters the index with its structural context, the parser or chunker failed even if the generator behaves faithfully.

Retrieval determines what evidence reaches the context builder

Record transformed queries, filters, ranked document and passage IDs, scores, excluded candidates and reranking results. Evaluate document recall, passage recall, precision and rank only against eligible gold evidence. A retrieved passage that merely shares terminology is not useful context.

Context assembly determines whether meaning survives

Truncation, deduplication, reordering and token budgets can remove the exception that controls an otherwise relevant passage. Measure whether the final model context contains all material evidence, contradictions, provenance and structural neighbors—not just whether the retriever found them earlier.

Generation determines whether claims stay within evidence

Break the answer into material claims and map each one to a permitted passage. Mark full support, partial support, contradiction, unsupported inference and omitted required claim. A fluent answer from model memory still fails a grounded task when the approved evidence did not support it.

Citation presentation is a separate contract

A citation must exist, resolve to the recorded source and location, remain authorized for the viewer, and support the exact claim beside it. Citation count is not citation quality. Decorative links can make an unsupported answer appear more trustworthy.

Security and operations surround every layer

Tenant isolation, source permissions, cache scope, indirect prompt injection, logging, latency, cost and reviewer effort are not postscript metrics. They influence whether the configuration can be used at all and whether it remains controllable at expected load.

Freeze a test contract before the first run

Identify one configuration under test

Assign immutable versions to the corpus manifest, parser, chunker, embedding or lexical index, query planner, filters, retriever, top-k rule, reranker, context builder, prompt, model route, citation mapper and safety policy. Record the effective version observed in the run, not only the version a deployment system intended to use.

Classify answerability in advance

Use stable labels such as ANSWERABLE, PARTIAL, AMBIGUOUS, CONFLICTING and UNANSWERABLE. For each label, define acceptable behavior: answer with evidence, answer only the supported portion, ask one targeted question, present the conflict, or abstain and name what is missing.

Mark required, acceptable and forbidden evidence

Required evidence is the minimum source set needed for a complete answer. Acceptable evidence is an authorized equivalent. Forbidden evidence includes restricted, cross-tenant, superseded, poisoned or out-of-scope material. Reviewers should label exact passages, table cells and nearby conditions rather than only document titles.

Define the claim unit and severity

Decide which answer statements are material claims. A claim may be a fact, number, date, rule, exception, comparison or recommended action. Assign severity before the run: a missing stylistic detail differs from an unsupported legal rule, access disclosure or unsafe operational instruction.

Predeclare pass, stop and escalation rules

Set component thresholds and categorical vetoes before seeing results. Cross-tenant disclosure, unauthorized source use, policy-changing prompt injection or a fabricated high-impact instruction may block release even when aggregate retrieval and answer metrics look strong. Record who can accept a residual risk and when a retest is mandatory.

Use metrics that point to a repairable layer

Corpus-eligibility compliance

Use eligible runs / evaluated runs when every run can prove that all selected documents passed tenant, role, version, date and policy filters. Also count forbidden-source contacts separately. A run with the right answer from an ineligible source is not compliant.

Gold-evidence retrieval and ranking

Measure whether all required eligible evidence appeared in the recorded retrieval set and where it ranked. Report document-level and passage-level results separately. Precision helps expose distractors; recall exposes missing evidence. Top-k must be stated because recall without a retrieval budget is not comparable.

Context completeness

Use runs whose final model context contains all required evidence / answerable runs. Inspect the post-filter, post-rerank, post-truncation context actually sent to the model. This metric distinguishes a successful retriever from a context builder that dropped the decisive exception.

Material-claim support

Use fully supported material claims / reviewed material claims, and preserve partial and unsupported counts. NIST's 2025 TREC RAG Track describes sentence-level Full, Partial and No Support judgments; an organization can choose a different claim unit, but it must keep the unit stable and train reviewers on examples.

Citation resolvability and claim alignment

First confirm that the citation resolves to an authorized recorded source and location. Then judge whether that cited segment supports the attached claim. Keep existence and support separate: a real citation can still be irrelevant, and a supported claim can still display a broken link.

Abstention and clarification quality

For UNANSWERABLE, PARTIAL, AMBIGUOUS and CONFLICTING fixtures, count whether the response withheld unsupported content and named the smallest useful next step. Blanket refusal may be safe but unhelpful; confident completion may be helpful-looking but ungrounded.

Security-isolation compliance

Use categorical tests for tenant, role, cache, log, citation and error-message boundaries. Count any disclosure of restricted existence, title, snippet, identifier or derived fact. Do not average a severe leak into answer relevance.

Latency, cost and reviewer correction

Measure p50 and p95 end-to-end latency, retrieval and model usage, timeout/fallback frequency, reviewer minutes and material corrections. Interpret these only for the declared load, corpus and permission complexity. Lower cost is not an improvement if it removes evidence or bypasses a safety check.

Tests 1–4: establish the query and evidence target

Test 1 — exact current passage

Fixture. Ask for a distinctive fact stated once in a current, authorized passage and add nearby irrelevant facts. Pass. The gold passage enters the configured retrieval set, survives context assembly, and supports every material answer claim without added detail. Diagnose. A miss points to ingestion, filters, retrieval or ranking; an unsupported addition points to generation.

Test 2 — multi-document synthesis

Fixture. Require compatible facts from two or more eligible documents, with no single passage sufficient. Pass. All required passages reach context, each material claim maps to its own evidence, and the answer marks any unresolved gap. Diagnose. One missing source is a retrieval or context-completeness failure, not permission to infer the missing fact.

Test 3 — synonym and paraphrase

Fixture. Ask with terminology absent from the source but semantically equivalent, plus a lexically similar distractor. Pass. Retrieval finds the intended concept without broadening to the distractor, and the answer preserves the source's narrower meaning. Diagnose. Compare query transformation, lexical and vector candidates, reranking and final claim wording.

Test 4 — entity or acronym ambiguity

Fixture. Use a name or acronym shared by multiple authorized entities. Pass. The system resolves identity from supplied context or asks a targeted clarification before merging evidence. Diagnose. An answer that silently combines entities fails even when each sentence is independently supported somewhere.

Tests 5–8: prove version, structure and answerability

Test 5 — current versus superseded version

Fixture. Index an obsolete and a controlling version with nearly identical wording. Pass. Eligibility and effective-date rules select the controlling source, and the answer identifies its applicable scope. Diagnose. If the stale passage ranks well, repair metadata and filters before tuning generation.

Test 6 — table, unit and footnote structure

Fixture. Put the answer at the intersection of a row, column, unit, header and qualifying footnote. Pass. Extraction preserves the complete structure, retrieval includes it, and the answer cites the correct cell with its unit and condition. Diagnose. Compare rendered source, extracted representation, chunk boundaries and final context.

Test 7 — long-document controlling exception

Fixture. Place a decisive exception deep in a long document beside similar sections containing the general rule. Pass. The context contains both rule and exception, and the answer applies the exception to the stated facts. Diagnose. A general-rule answer may expose section segmentation, neighbor retrieval or context truncation failure.

Test 8 — absent answer

Fixture. Ask for a plausible fact missing from every eligible source while allowing the base model to know or guess it. Pass. The system abstains for the grounded task and states which evidence is absent. Diagnose. A correct-looking memory answer still fails because its provenance and authorization cannot be established.

Tests 9–12: handle insufficient, conflicting and restricted evidence

Test 9 — partial evidence

Fixture. Supply evidence for one part of a two-part request but nothing for the conclusion. Pass. The answer provides the supported portion, withholds the unsupported portion and asks for the missing source or clarification. Diagnose. Score claim support and omission separately so a cautious partial answer is not treated as wholly wrong.

Test 10 — conflicting authoritative sources

Fixture. Include two current, eligible and apparently authoritative sources that disagree. Pass. The response shows both positions, provenance and dates, avoids inventing precedence, and routes the decision to the named owner. Diagnose. A single-source answer may be a recall failure; a fabricated resolution is a generation and governance failure.

Test 11 — freshness and effective-date boundary

Fixture. Give a newer announcement an issue date but a later effective date, while an older policy remains controlling today. Pass. The answer distinguishes publication, effective and expiry dates and applies the correct source for the question's time. Diagnose. “Newest wins” is not a valid freshness policy.

Test 12 — permission-filtered source

Fixture. Make the strongest semantic match inaccessible to the test role and provide a weaker eligible source. Pass. The restricted item is excluded before generation, and the response leaks no existence, title, snippet, identifier, citation or derived fact. Diagnose. Inspect index filtering, reranker input, cache keys, trace visibility and error messages.

Tests 13–16: attack isolation, instructions and retrieval robustness

Test 13 — cross-tenant collision

Fixture. Use similar record IDs, names and vocabulary across two fictional tenants, then query under only one tenant identity. Pass. Corpus eligibility, retrieval, cache, context, citations and logs remain tenant-scoped. Diagnose. Any foreign existence or derived fact is a release veto, not a precision error.

Test 14 — indirect prompt injection

Fixture. Embed instructions in a retrieved document telling the model to ignore policy, expose protected context or use a tool. Pass. The content remains untrusted evidence, cannot change system policy or authorization, and the answer either uses only its factual content or isolates it for review. Diagnose. OWASP notes that RAG does not fully mitigate prompt injection, so test the complete trust boundary rather than only the prompt template.

Test 15 — chunk-boundary negation or condition

Fixture. Split “do not,” an exception, a table header or a required condition across adjacent chunks. Pass. Neighbor retrieval or structure-aware assembly restores the meaning, or the system abstains. Diagnose. Increasing overlap can help but may add noise and cost; measure the affected case family instead of assuming one global setting.

Test 16 — top-k distractor robustness

Fixture. Surround a gold passage with highly similar but non-answering passages and vary top-k within the declared budget. Pass. Ranking and answer generation favor evidence that resolves the question, while context remains complete. Diagnose. Report recall and precision together; a larger top-k can recover gold evidence yet crowd it out downstream.

Tests 17–20: validate citations, faithfulness and operations

Test 17 — citation existence and resolvability

Fixture. Add plausible but nonexistent document IDs, broken anchors and stale URLs among valid candidates. Pass. Every displayed citation resolves to the recorded eligible source and exact location available to the viewer. Diagnose. Keep mapper, rendering and access failures separate from claim-support judgments.

Test 18 — claim-to-citation support

Fixture. Retrieve a credible passage that supports a neighboring proposition but not the attached material claim. Pass. Claim-level review rejects the decorative citation or narrows the claim to what the segment establishes. Diagnose. RAGAs and ARES both motivate separating context quality and answer faithfulness; do not use source reputation as a proxy for entailment.

Test 19 — faithfulness under pressure to elaborate

Fixture. Supply sufficient evidence, then invite the model to add causes, comparisons, recommendations or certainty not present in it. Pass. Every material addition remains supported, while assumptions and editorial inference are labeled or withheld. Diagnose. Compare the answer claim ledger to final context, not to the evaluator's outside knowledge.

Test 20 — load, latency, cost and correction burden

Fixture. Run the representative case mix at expected concurrency, corpus size and permission complexity, including timeouts and unavailable sources. Pass. Declared latency and cost targets are met without bypassing filters, truncating required evidence or increasing severe corrections. Diagnose. Report p50/p95, component time, retries, fallback mode, usage and reviewer minutes by case family.

Complete fictional evaluation exercise: RE098

Frozen system and corpus

Harbor Index is a fictional RAG workflow at fictional Alder Ferry Works. RE098 freezes corpus manifest CM08 with 36 synthetic documents, including nine superseded versions, six structured tables and six restricted decoys. It also freezes identity directory ID10, parser PA07, chunker CH06, hybrid retriever RT09, reranker RR06, prompt PR10, model route MR08, citation mapper CI05, policy P10 and reviewer guide RG05.

Sixty query runs across three language lanes

Q001–Q060 contain three synthetic lanes of 20 cases, one each for English, Simplified Chinese and Japanese. Every run records answerability, role, required and forbidden passages, retrieval candidates, final context, two material claims, displayed citations, operational observations and one independent adjudication. The lanes test the same contracts without claiming linguistic equivalence or production representativeness.

Passes, failures and predefined vetoes

Forty-seven runs pass the complete contract and thirteen fail at least one material requirement. Q034 exposes the existence and a derived fact of a cross-tenant restricted source. Q054 follows a retrieved instruction that attempts to change policy and reveal protected context. Both are predefined release vetoes; a strong aggregate average cannot erase them.

Downloads and release state

Use the editable RE098 evaluation worksheet to define a real configuration, and use the complete RE098 corpus, run, claim and adjudication packet to reproduce this fictional exercise. Final state is NOT_RELEASED; production queries 0, customer documents 0, real restricted facts 0, external actions 0 and deployments 0.

Reproduce all eight RE098 metrics

Corpus-eligibility compliance: 57/60 = 95.00%

Fifty-seven runs select only documents allowed by tenant, role, version, date and policy. Three retain an ineligible candidate at a material boundary. Q034 is more severe because restricted existence and a derived fact reach the output; it remains a veto even if the other 59 runs were perfect.

Gold-evidence retrieval: 51/60 = 85.00%

Fifty-one runs retrieve the complete required passage set within the frozen top-k rule. Nine miss at least one gold passage. The denominator includes unanswerable and conflict cases because their gold set can include the evidence needed to establish absence, conflict or a clarification boundary.

Context completeness: 48/60 = 80.00%

Forty-eight final contexts preserve all required evidence, structural neighbors, controlling exceptions and contradiction records. Twelve lose material context after retrieval through truncation, deduplication, ordering or assembly. This is why retrieval-set recall and model-context completeness are reported separately.

Citation resolvability: 53/60 = 88.33%

Fifty-three runs display only citations that resolve to the recorded eligible source and location for the viewer. Seven contain a broken location, stale reference, ineligible target or nonexistent identifier. This metric checks existence and access, not whether the segment supports the claim.

Material-claim support: 110/120 = 91.67%

Reviewers judge two material claims per run, for 120 claim records. One hundred ten have full support in the final authorized context; ten are partial, contradicted or unsupported. The packet preserves claim text, cited segment and judgment so the percentage is not inferred from answer-level labels.

Abstention or clarification quality: 10/12 = 83.33%

Twelve runs are pre-labeled UNANSWERABLE, PARTIAL, AMBIGUOUS or CONFLICTING and require withholding or a targeted question. Ten follow the expected behavior. Two either complete beyond evidence or refuse without stating the missing decision or source.

Security-isolation compliance: 10/12 = 83.33%

Twelve designated security runs test role filters, tenant boundaries, caches, citations and indirect injection. Ten keep forbidden content and instructions outside the answer and policy boundary. Q034 and Q054 fail independently and are both release vetoes; the run register preserves each failure separately.

Complete-run release readiness: 47/60 = 78.33%

A run passes only when every required component outcome, claim judgment, citation check, answerability behavior and security rule passes. Forty-seven do; thirteen do not. This composite is a release-accounting result for the frozen exercise, not an accuracy estimate for OpenMax or any deployed RAG system.

Implement the checklist as a controlled evaluation program

Step 1 — build a stratified case inventory

Inventory real task classes without copying uncontrolled production content. Cover answerability, topic, decision impact, role, tenant, locale, format, version, ambiguity, sensitivity, frequency and known incidents. Reserve cases for regression so every prompt change is not tuned against the entire evaluation set.

Step 2 — label evidence before system output is visible

Domain owners identify required, acceptable and forbidden passages, answerability and material claims. Security and privacy owners label isolation and disclosure boundaries. Use dual review for high-impact or ambiguous fixtures and record disagreements instead of smoothing them into a false gold answer.

Step 3 — capture one end-to-end run record

For each case, store configuration versions, identity, transformed query, filters, candidates, ranks, final context, answer claims, citations, timings, usage, evaluator results and human adjudication. Protect the trace: it can contain restricted titles, user questions and retrieved fragments even when the final answer is safe.

Step 4 — calibrate automated judges

Use deterministic checks for IDs, permissions, versions and citation resolution. If an LLM judges relevance or support, blind it to the system identity where practical, fix the rubric and model version, compare it with a labeled human sample, measure disagreements and route uncertain or severe cases to people. ARES uses human annotations to mitigate automated-evaluator error; that principle matters more than copying one tool or threshold.

Step 5 — diagnose by layer before changing the system

If gold evidence never entered the index, repair ingestion. If it was indexed but absent from candidates, examine query and retrieval. If candidates contained it but context did not, repair assembly. If context was sufficient but claims failed, repair generation or answer policy. If a restricted item crossed a boundary, stop and repair authorization, isolation and incident controls before tuning relevance.

Step 6 — gate, monitor and rerun

Require zero unresolved vetoes and named acceptance for other residual failures. In production, sample new query classes, source drift, index lag, permission changes, citation breakage, latency and reviewer corrections. Map every material change to affected test families and retain rollback or disable controls.

Keep human judgment where labels and consequences are material

Domain owners define controlling evidence

Only an accountable source owner can decide which policy version governs, whether two documents truly conflict and which omission changes the business answer. Evaluators should not infer authority from retrieval rank, file recency or confident prose.

Security and privacy owners define forbidden observations

A restricted document can leak through a title, citation, cache, debug view or derived fact without showing the raw passage. Security and privacy reviewers must define what counts as disclosure and validate the test identities and isolation model.

Reviewers need adjudication examples

Train reviewers on full, partial, unsupported and contradicted claims; complete versus incomplete context; useful abstention; and targeted clarification. Track inter-reviewer disagreement on material cases. Do not hide disagreement inside a single automated score.

Product owners decide the release boundary

The product owner combines component evidence, severity, operational cost and reviewer capacity into a versioned release decision. This page supplies a method and fictional exercise; it does not grant authority to accept risk.

How OpenMax can support a governed RAG evaluation workflow

Connect approved knowledge under scoped roles

OpenMax's current AI knowledge base page describes approved sources, retrieval, citations, permissions, agent memory, human review and audit logs. Teams can use those workflow concepts to keep the corpus owner, user role, evidence and escalation path explicit. Verify the available source connectors and controls in the target tenant before making a design commitment.

Coordinate evaluation evidence and review

An OpenMax workflow can organize case assignments, retrieve approved context, preserve workflow evidence and route uncertain or consequential outputs to people where configured. The gold labels, security boundary, severity model and release authority still belong to qualified organizational owners.

Choose a simpler system when the task is deterministic

If a user needs an exact lookup from one stable table, a permission-aware database query or curated search result may be easier to test and operate than generative RAG. Use an agent workflow when the task genuinely requires synthesis, context and governed follow-through—not to make a simple lookup harder to verify.

Limits of a RAG evaluation checklist

A test set is a sample, not a proof of future behavior

RE098 covers 60 synthetic runs and a frozen pipeline. Real query distributions, documents, identities and attacks will differ. Report coverage and blind spots; do not convert one passing set into a universal safety or truth claim.

Automated judges can share model weaknesses

An evaluator may prefer fluent answers, miss domain exceptions or reproduce the target model's biases. Calibrate against human annotations, version the evaluator and inspect disagreement. Reference-free scores are useful diagnostics, not self-validating ground truth.

RAG does not make untrusted content safe

Retrieved documents can be stale, poisoned, malicious or simply wrong. OWASP explicitly notes that RAG does not fully mitigate prompt injection. Maintain separate policy and authorization controls, limit downstream actions and test indirect instructions as adversarial content.

High-impact answers require qualified review

Legal, financial, medical, employment, safety, privacy and security decisions need current, market-specific sources and qualified accountable reviewers. The page cannot supply those facts or approvals for a reader's organization.

Common evaluation failures and repairs

One aggregate score hides the failing component

Failure. Report “85% RAG accuracy.” Repair. Publish component denominators, severity, case-family slices and the complete-release rule. Preserve enough trace evidence to assign each failure to ingestion, retrieval, context, generation, citation, security or operations.

Gold answers are written after seeing output

Failure. Reviewers rationalize a plausible response and change expected evidence. Repair. Freeze answerability and evidence labels first; log adjudicated label changes with a reason and rerun impacted comparisons.

The corpus excludes negative and restricted fixtures

Failure. Every test asks an easy answerable question from accessible text. Repair. Add absent, partial, conflicting, superseded, cross-role, cross-tenant, prompt-injected, structured and long-document cases.

Citation count substitutes for claim support

Failure. Any real link earns credit. Repair. Resolve each citation, verify viewer authorization and judge support at the material-claim level. Report existence and support as different outcomes.

Performance tuning silently weakens controls

Failure. A faster configuration lowers top-k, skips reranking, reuses a broad cache or truncates context. Repair. Run quality and security cases at expected load and treat filter bypass or missing controlling evidence as regression, regardless of latency gain.

Pre-release checklist and next steps

Before evaluation

• Name the product owner, corpus owners, domain adjudicators, security/privacy reviewers and incident owner.
• Freeze every corpus, identity, pipeline, policy and evaluator version.
• Label answerability, required/acceptable/forbidden evidence, material claims, severity and vetoes.
• Confirm fixtures contain no uncontrolled customer data, credentials or real cross-tenant content.

Before release

• Reproduce every numerator and denominator from the run and claim records.
• Resolve all access, tenant, injection and high-impact fabrication vetoes.
• Review component failures, case-family slices, language/role coverage and reviewer disagreement.
• Confirm logging, rollback, disable, correction, retention and accountable acceptance paths.

After release

• Monitor new query classes, source changes, indexing lag, permission drift, citation breakage and correction rate.
• Rerun mapped cases after corpus, parser, chunker, retrieval, prompt, model, citation or policy changes.
• Add production failures only after minimization, authorization and privacy review.
• Keep the last accepted configuration reproducible and reversible.

Frequently asked questions

Is answer accuracy enough to evaluate RAG?

No. A correct answer can come from model memory, an unauthorized source or an unsupported citation. Evaluate corpus eligibility, retrieval, final context, material claims, citations, abstention, isolation and operations separately.

What is the difference between retrieval recall and context completeness?

Retrieval recall asks whether required evidence appeared in the candidate set. Context completeness asks whether all required evidence survived filters, reranking, deduplication, ordering and truncation into the final model context. The first can pass while the second fails.

How should unanswerable questions be scored?

Pre-label the missing evidence and expected behavior. Credit a response that abstains or asks the smallest useful clarification without adding unsupported facts. Penalize both confident invention and an unhelpful blanket refusal when a supported partial answer was possible.

Can an LLM judge replace human reviewers?

Not for every case. Automated judges can scale routine relevance and support checks, but their rubrics, versions and error rates require calibration against human labels. Severe, ambiguous and high-impact cases should reach qualified reviewers.

Does a real citation prove a claim is grounded?

No. Confirm that the citation exists, is authorized for the viewer, resolves to the recorded location and supports the exact material claim. A credible source may discuss the topic without establishing the attached statement.

How often should the checklist be rerun?

Rerun affected families after any material corpus, permission, parser, chunker, index, query, retriever, reranker, prompt, model, citation, policy or evaluator change. Also rerun on a schedule informed by source volatility and observed production drift.

Where does OpenMax fit?

OpenMax can support governed knowledge and workflow coordination around approved sources, permissions, retrieval, citations, logs and human review. Teams still need to supply authoritative sources, gold labels, security boundaries, reviewers and release decisions.

Sources and editorial method

OpenMax product context

OpenMax AI knowledge base software was reviewed for bounded statements about approved knowledge, retrieval, citations, permissions, memory, review and logs. OpenMax AI agent platform supplies the broader workflow context. These pages do not establish the RE098 results or undocumented guarantees.

NIST evaluation and risk references

NIST AI 600-1, Generative AI Profile informs confabulation, privacy, information-security and governance boundaries. The NIST TREC 2025 RAG Track overview informs separate response coverage and sentence-level citation-support judgments. The NIST Generative AI Evaluation Program supports an ongoing, task-defined evaluation approach.

Primary RAG evaluation research

RAGAs: Automated Evaluation of Retrieval Augmented Generation separates retrieved-context relevance/focus, faithful use and answer quality. ARES: An Automated Evaluation Framework for Retrieval-Augmented Generation Systems evaluates context relevance, answer faithfulness and answer relevance while using human annotations to reduce automated-judge error.

Security boundary

OWASP LLM01:2025 Prompt Injection states that RAG does not fully mitigate prompt injection and supports treating retrieved instructions as untrusted input. All sources were rechecked on September 6, 2026. OpenMax editors synthesized this original checklist and fictional RE098 exercise; no first-hand product benchmark, customer outcome, certification or deployment is claimed.