Attachments and files

AgentID protects files by turning them into text, masking that text, and giving the AI a protected text copy instead of the original file.

Supported formats

Format	Notes
PDF	Text layer first; scanned pages need OCR
DOCX	Document text; embedded images can use OCR
XLSX, XLSM	Visible and hidden sheets, cell values, formulas and cached results, comments, named ranges and metadata. Macros are detected but never executed
PPTX	Slide text
Markdown (`.md`, `.markdown`), TXT, CSV	Read as UTF-8 text
Images (PNG, JPEG, WebP, GIF, BMP, TIFF)	Need OCR

Limits: up to 4 files per request. A direct Guard API request is limited to 4 MiB in total, and inline text to 500,000 characters per file. The browser extension and the Claude plugin upload larger documents through a private, one-time staging upload: up to 16 MiB per file and 32 MiB per request. Staged files are deleted right after their text is extracted.

How each integration handles files

Integration	Behaviour
Browser extension	Intercepts supported uploads and attaches a protected `.txt` copy instead of the original. The original document is never uploaded after protection
Claude plugin	Replaces supported documents with private masked text copies before a tool reads them
Claude Desktop companion (Windows)	Protects files added with Claude's Add files or photos; files dragged into the window are not protected
Claude Desktop companion (macOS)	No attachment protection yet
Guard API and SDKs	Send files in the `attachments` array; Guard returns `transformed_attachments`

Guard API attachments

Send each file as extracted text or as base64 bytes:

{
  "system_id": "cf84f936-95bc-45a4-bf98-9a1a16bf29c9",
  "input": "Summarize the attached contract.",
  "attachments": [
    {
      "filename": "contract.pdf",
      "mime_type": "application/pdf",
      "content_base64": "JVBERi0xLjcK..."
    }
  ]
}

When masking is on and extraction succeeds, the response contains the protected text per file:

{
  "allowed": true,
  "transformed_input": "Summarize the attached contract.",
  "transformed_attachments": [
    {
      "filename": "contract.pdf",
      "mime_type": "application/pdf",
      "transformed_text": "Agreement between <ORGANIZATION_NAME_1> and <PERSON_NAME_1> ...",
      "source": "base64_file"
    }
  ]
}

Send transformed_text to the model instead of the file. Prompt and attachments share one placeholder set, so a name in the prompt and in the file gets the same placeholder.

When a file cannot be read

If a file yields no text (for example a scanned PDF without OCR), the item reports an extraction error or requires_ocr: true instead of pretending the file was protected.
If Block Personal Information or Block Secrets & API Keys is on, such a request is blocked with reason attachment_requires_secure_preprocessing.
When masking is on, AgentID does not forward files to a remote OCR service; only AgentID's own OCR is used.

Content policies

Extracted text is also checked against your content policies and document policies.