Every AI product on the market will answer questions about a PDF you hand it. Upload, ask, get a fluent summary. For reading comprehension, that solved problem stays solved.
Then a different kind of question arrives. An auditor asks why your gap analysis marked access control as largely compliant. The finding says "the ISMS policy requires reviewed change tickets for production access." The policy has been revised twice since the assessment. Which paragraph said that? Does it still? Can anyone show what the text was on the day the finding was written?
Chat-with-your-PDF has no answer. The conversation is gone, the document moved on, and the claim is now an unverifiable assertion wearing the costume of an assessment. This post is about the other way to do it.
A citation of your document, shaped like a citation of the law#
We have written before about the citation contract for statutes: a citation is a provision URI that resolves, text that matches, and a refusal when neither holds. The same contract applies to documents you upload.
When your agent cites an uploaded document through the Ansvar gateway, the citation is not "the retention policy" — it is one paragraph, addressed and fingerprinted:
doc://3fa2c1d8-…/segment/paragraph/14
"Access to production systems requires a reviewed change ticket."
sha256: 9c41…
Three properties follow, none of which a document link can offer:
- Addressable. The claim points at paragraph 14, not at a 40-page file. A reviewer goes straight to the text that carried the obligation.
- Verifiable.
resolve_document_segmentround-trips the URI and returns the verbatim text plus its hash. Match: the citation still holds. Mismatch: the document changed since the finding was written — and now you know, instead of not knowing. - Uniform. The citation object has the same shape whether the source is GDPR Article 32 or your own information-security policy. Tooling downstream — GRC imports, audit packages, review checklists — handles one format.
The mechanics are deliberately boring: your agent uploads through a presigned URL into your tenant's library, the document is parsed into segments, and two read tools do the anchoring from then on. The full loop is documented in Cite your documents.
Who this is actually for#
The feature reads as infrastructure. Its value shows up in specific professions — the ones whose output gets challenged.
In-house counsel and law firms. Contract and policy review where every finding pins the clause it rests on. The review workflow is built around exactly this discipline: a structured assessment of one document in which every finding must carry a paragraph anchor — an integrity stamp on the deliverable, not just on the process.
Data protection officers. A DPIA is only as defensible as its evidence trail. Processing records, transfer agreements, retention schedules — uploaded once, cited paragraph-by-paragraph in the report, checkable when the supervisory authority asks eighteen months later.
Information security and GRC teams. Gap analyses that map your ISMS policy paragraphs against framework controls, instead of asserting coverage from memory. When the policy is revised, the drift check tells you which findings need a second look — revision management for compliance claims.
Procurement and bid teams. The tender-review workflow decomposes an uploaded tender per requirement, so every coverage judgment traces to the requirement text it answered.
Auditors and consultants. Deliverables whose evidence registers survive scrutiny. A consultant's report where every claim round-trips to a hash-verified paragraph is a different product from a report that cites "the documentation provided."
The honest limits#
Uploaded-document citations do not make a claim true — they make it checkable. A finding can still misread the paragraph it cites; what it cannot do is drift silently or point at nothing. The refusal discipline applies here as everywhere on the platform: a claim that cannot be anchored ships marked as unresolved, not decorated with a plausible-looking reference.
And your documents stay yours: tenant-scoped storage, your retention policy, and a fleet of legal corpora that never see client data by design.
If your work product gets challenged — by auditors, regulators, counterparties, or your own future self — the difference between document Q&A and document evidence is the difference between an opinion and a record. The setup takes one upload: Cite your documents.