Cite your documents

The gateway doesn't only cite law — it cites your documents the same way. Upload a policy, contract, or tender file to your document library and every claim your agent makes about it can carry a paragraph-level anchor: a doc:// URI plus a content hash that proves what the paragraph said when it was cited. That is what makes an assessment reviewable months later, after the document has been through three more revisions.

Upload — three calls your agent makes

Say "upload this DPIA draft to my library" and the agent runs:

register_document_init(filename, mime_type, file_size)
   → { document_id, presigned_put_url, expires_at }
# the agent PUTs the file bytes to presigned_put_url
register_document_finalize(document_id)
   → { status: "ready", sha256 }

Parsing runs at finalize; when the status comes back ready, the document is segmented and citable. list_my_documents shows the library (each document has an id, short code, filename, and status); delete_my_document removes one. The library is tenant-scoped — documents are visible to your organization's seats, not to anyone else.

Cite — segments, not whole files

Two read tools do the anchoring. get_document_segments returns a document's paragraphs with their segment references. resolve_document_segment goes the other way: give it a doc:// URI and it returns the verbatim text plus the content hash — the round-trip an auditor runs to check a citation. A citation looks like:

doc://3fa2c1d8-.../segment/paragraph/14
"Access to production systems requires a reviewed change ticket."
sha256: 9c41...  (matches — text unchanged since cited)

Whole-document citations lose the tamper-evidence guarantee — if a finding says "the policy covers incident response" with no paragraph anchor, nobody can verify which text carried that claim. Ask your agent to cite at paragraph level; the workflows do it by default.

Where this shows up

• Workflows — evidence documents bind to a run via register_document; findings then cite your uploaded evidence at paragraph level alongside the regulatory citations. The review workflow is built entirely around this: a structured assessment of one document where every finding must carry a doc:// anchor (see Workflows).
• Ad-hoc analysis — "compare our retention policy §4 against GDPR Article 5(1)(e)" works as a plain conversation: the agent pulls your paragraph and the statute, both cited.

Want to see the real thing? A full captured run — a retention policy reviewed against GDPR storage limitation, every finding hash-anchored — is at the document-review worked example.

Tiers

Reading segments (get_document_segments, resolve_document_segment) is Premium and above. The library itself — uploading, listing, deleting, and binding documents to workflows — is Team and Company, alongside the workflows that consume it.