Decide how untrusted content may be used.

How the decision is made

From bytes to a decision you can defend.

A verdict on its own is not much use. What matters is the chain that produced it: what the content is, what it can do, how strongly that is known, who is about to consume it, and what the analysis never managed to look at.

• How did it arrive? Sender, origin, repository revision, sharing scope, quarantine state and custody. The same bytes can deserve a different answer depending on where they came from.
• What is it really? Identity from content, every accepted interpretation, and nested assets expanded recursively. A file that can be read two ways is analysed every way — though a polyglot signature alone never convicts.
• How strongly is that known? Evidence carries its derivation and completeness, not just its conclusion. Verdicts decompose into named contributions, and near-misses, demotions and suppressions stay traceable.
• What can it actually do? Capabilities are normalised across carriers into effects — execution, external retrieval, disclosure, coercion, machine influence — so a rename or a repackage doesn't defeat the control.
• Who is about to consume it? A reader, a renderer, a retrieval indexer and a tool-using agent are exposed differently by the same capability.
• What was never looked at? Skipped providers, encrypted members, exhausted budgets and unsupported surfaces stay visible — and qualify the decision instead of quietly passing it.