How AI tools access files: uploads versus workspaces
Learn how AI tools access files through chat uploads and coding-agent workspaces, what each route exposes, and which checks belong before AI use.
Read article.mdSiren field notes
Document security for better AI systems.
Practical guidance on prompt injection, document handling and governance for agents, knowledge bases and AI workflows.
Start here · Foundational guide
What is prompt injection? How it reaches AI through documents
Learn how prompt injection can reach AI through external documents, what the warning signs mean and which layered checks can reduce risk before use.
Read the guideGuides and articles
Find the guidance your AI workflow needs.
39 resources · including the featured guide above
ChatGPT file upload limits and supported file types
Check current ChatGPT file upload limits, supported document types and the separate caps for files, images, spreadsheets, Projects and storage.
Read article
ChatGPT file upload not working? A practical fix guide
Fix common ChatGPT file upload errors by checking format, size, rate and storage limits, service status, browser state and workplace network controls.
Read article
Can ChatGPT read PDFs?
Learn when ChatGPT can read PDF text, scanned pages, charts and embedded images, why plan and upload route matter, and how to check the result.
Read article
Gemini Apps file upload limits and supported file types
Check current Gemini Apps file upload limits for documents, media, ZIPs, code folders and repositories, plus the caveats that affect analysis.
Read article
Claude file upload limits and supported file types
Check current Claude.ai file upload limits, supported document and image types, PDF handling, chat caps and the separate rules for Project files.
Read article
Codex sandbox explained: modes, boundaries and approvals
Understand what the Codex sandbox isolates, how its modes differ from approval policy, and what files, writes and network access still require review.
Read article
Codex permissions and workspace access explained
Learn how Codex permissions control local file and network access, how profiles differ from legacy sandbox settings, and where document checks fit.
Read article
Claude Code sandbox explained
Understand how the Claude Code sandbox constrains Bash, how auto-allow differs from permissions, and which file and network exposures still need attention.
Read articleClaude Code permissions and workspace access explained
Learn how Claude Code permissions, modes and working-directory rules govern file access, and how those controls complement its Bash sandbox.
Read article
Prompt injection statistics 2026: what the data actually shows
Explore prompt injection statistics for 2026, with source context on research papers, resumes, PDF detection and what the benchmarks actually measure.
Read articleHow to check a document for prompt-injection signals
Learn how to check a document for prompt-injection signals, assess coverage and limits, and decide whether it should enter an AI workflow.
Read article
CV and resume prompt injection: evidence, risks and checks
Understand hidden prompts in CVs and resumes, what early evidence shows, and how recruiters can review documents before AI-assisted screening.
Read articlePDF prompt injection: when AI reads more than the page shows
Learn how hidden or machine-readable PDF content can reach AI workflows, what current detection research shows, and how to review a PDF before use.
Read article
Prompt injection examples: six patterns in documents and AI workflows
See harmless prompt injection examples from documents and AI workflows, learn what each pattern tries to change and understand the right next step.
Read articleHidden prompt injection in research papers: what the evidence shows
See what current studies show about hidden prompts in research papers, where the evidence stops, and how to check papers before AI-assisted review.
Read article
What is indirect prompt injection in a document?
Learn how indirect prompt injection travels from external documents into AI context, how it differs from direct injection and which controls reduce risk.
Read articleHow to build an internal AI knowledge base
Build an internal AI knowledge base from governed company documents, with a practical blueprint for ownership, retrieval, permissions, testing and upkeep.
Read articleRAG pipeline architecture: components, stages and decisions
Understand RAG pipeline architecture from source preparation and indexing through retrieval, generation, evaluation, refresh and control points.
Read articleContext engineering for AI agents: a practical guide
Learn how to engineer context for AI agents across instructions, tools, retrieved knowledge, memory, history, limits and evaluation.
Read articleWhat is an AI agent harness? Components and controls
Learn what an AI agent harness is, how its runtime components fit together, and where permissions, observability, context and safety controls belong.
Read articleHow to prepare documents for RAG
Prepare documents for RAG with a practical checklist for selection, permissions, parsing, metadata, versioning, chunking, testing and ingestion.
Read article
RAG chunking strategies: how to choose and test them
Choose and test RAG chunking strategies using document structure, metadata, retrieval quality and task-specific evaluation instead of fixed defaults.
Read article
How to build a local RAG system
Build a local RAG system and compare local, self-hosted, on-premises and cloud choices without treating deployment location as a security guarantee.
Read articleRAG access control: preserving permissions through retrieval
Design RAG access control that preserves source permissions through indexing, retrieval and generation, with practical patterns and failure checks.
Read articleRAG security: risks, controls and a practical threat model
Threat-model a RAG system across documents, indexing, retrieval and generation, then apply layered controls for permissions, provenance and testing.
Read article
RAG evaluation: metrics, test sets and release gates
Evaluate a RAG system with test sets, retrieval and answer metrics, security tests, release gates and regression monitoring tied to real user tasks.
Read article
AI acceptable use policy: a practical template
Use this AI acceptable use policy template to define approved tools, prohibited uses, data-handling rules, human review and escalation.
Read article
AI governance framework: a practical guide
Build a practical AI governance framework covering ownership, inventory, risk tiers, approval, monitoring, incidents and improvement.
Read article
AI governance policy: a practical guide
Learn how to write an AI governance policy covering scope, decision rights, risk ownership, approvals, monitoring, exceptions and review.
Read article
AI policy template for organisations
Use this copy-and-adapt AI policy template to define scope, approved tools, data handling, human oversight, disclosure, incidents and review.
Read article
AI risk assessment template: a practical guide
Use this AI risk assessment template to assess a use case, record evidence, rate risks, assign controls and decide whether to proceed.
Read article
AI vendor risk assessment: checklist and template
Assess an AI supplier's data handling, security, model controls, incident response and contract terms with this practical checklist and template.
Read article
Data classification examples: 12 worked cases
See 12 worked data classification examples for documents and business data, including ambiguous cases where context changes the answer.
Read article
Data classification levels: a practical guide
Learn how data classification levels work, compare common schemes and adapt a practical Public, Internal, Confidential and Restricted model.
Read article
Data classification matrix: map levels to handling controls
Use this data classification matrix template to map Public, Internal, Confidential and Restricted information to practical handling controls.
Read article
Data classification policy template: a practical guide
Use this practical data classification policy template to define levels, ownership, handling rules, exceptions and review for your organisation.
Read article
Sensitive data classification: categories and criteria
Learn how to identify and classify sensitive data using content, context, legal duties, aggregation risk and the likely impact of compromise.
Read articleShowing 9 of 38 articles.