The system reads inbound correspondence and turns it into structured records. There are two questions it has to answer for every message. Whose record is this, and what does it say. It is tempting to treat those as one problem, hand the whole message to a model, and take the structured object it hands back.
That works until the message is a forward. Then the model attributes the record to whoever forwarded it, because that is who the message is visibly from, and it does so with exactly the same confidence it shows when it is right. The record lands in the wrong person's row. Nothing flags. It is found weeks later, if at all.
So we took the question away. Every inbound address is bound, by hand, once, to a person and their active assignments. A person who legitimately writes from three addresses has three bindings. An address with no binding produces no record at all — the message is refused and held, and someone maps it. Lookups do not hallucinate.
What remains for the model is the second question, asked inside a context that is already resolved. Not what is this message about, but find these known values in this document. The expected shape is implied by the assignment before the model reads a word. Format stops being interesting: a document, a spreadsheet, and a photograph of a printed page all reduce to the same assertion.
The general form of this is worth stating plainly, because it applies well beyond correspondence. When a model is unreliable, the instinct is to improve the prompt. Usually the better move is to find the sub-question where being wrong is silent and expensive, and answer that one by rule instead. What is left is often something the model is genuinely good at.
The cost was a mapping step that a person does once per address. The return was the removal of an entire class of failure that no amount of prompting would have closed.