1. Preserve the document you received

Keep the original unchanged. Record where it came from and, where practical, its filename, date and source.

This gives you a reference if a converted or cleaner copy is created later. It also helps confirm that the document reviewed is the version eventually used.

2. Confirm the source and intended use

Risk depends partly on the destination. A file used for a one-off summary has a different exposure from one added to a long-lived project with powerful integrations.

  • Did I expect to receive this document?
  • Is its source known?
  • What will the AI be asked to do with it?
  • Does the task require the full document?
  • Will the AI have access to files, messages or external tools?

3. Identify sensitive content

Review whether the document contains credentials, personal information, confidential material, private links or details the destination service does not need.

Remove unnecessary information from a separate working copy where appropriate. Preserving the original maintains provenance while reducing what crosses the next boundary.

4. Scan before adding it

Run the version you intend to use through SourceReady. Read the decision first, then the explanation, recommended next action, findings, coverage and limits.

Keep a Held document outside the project while you investigate. If you create a separate cleaner PDF, scan that copy again and confirm its visible content still matches what you need.

5. Constrain downstream use

  • Give the AI only the permissions needed for the task.
  • Keep consequential actions behind human approval.
  • Ask for source-linked outputs where evidence matters.
  • Review generated conclusions before they become decisions.
  • Re-scan the document if the file changes.

The reusable checklist

  • I know where the document came from.
  • I have preserved the original.
  • I know why the AI needs it.
  • I removed unnecessary sensitive information.
  • I scanned the version I intend to use.
  • I reviewed the decision, findings, coverage and limits.
  • Any Held document remains outside the project.
  • The destination AI has only the permissions it needs.
  • A person will approve consequential outputs or actions.

Sources and further reading

Primary guidance used to check the technical claims in this article.