References

Inline chips that point at another document, a register, a control, a risk or a connected source, and stay current as those records change.

A reference is an inline chip in your text that points at something else in the workspace. A chip is a dot and a name: every chip wears the same quiet neutral, whatever kind of thing it points at, and the one colour on it is the aliveness dot — green when the target is verified alive, amber when its source cannot be reached, red when it is gone. What kind of thing a chip points at is one hover away, and one click opens its popup. Unlike typing a name by hand, a chip resolves against live data every time the document is opened — so it shows the target's current name, and it tells the reader when the target is gone. Use one whenever a procedure names another document, a control, or a system you pull records from.

Datasets count towards your storage

A dataset you upload to reference — and the control datasets behind imported files — are files your workspace keeps, so they count towards its storage limit. An upload that would take you past it is refused before the file is stored, leaving your usage unchanged; removing a dataset gives the space back. See Seats and licences.

The kinds

Kind	Points at	Where it comes from
Document	Another document in your workspace	The reference picker
Register	A register in your workspace — the running log a claim rests on	The reference picker
A table in a register	One table inside a register, rather than the whole thing	The reference picker
Risk	A risk record — the risk a sentence treats or accepts	The reference picker
Action	One agreed step on a risk record — the thing somebody is actually doing about it, and the level at which work on a risk is assigned to a person	The reference picker
Control	A control record	The reference picker
Connected app	One of the systems you have connected — your ticket tracker, your drive	The reference picker's Connectors row
A rolling set	A team's whole holding of one kind — "all documents of this team", "all risks" — as ONE reference, marked ⊞	The reference picker
External document	A document you did not author — a supplier's terms, a certificate, a regulator's notice — held in governance as a file under version control	The reference picker's External documents section
File	A file imported into a single document. No longer something you can insert — see below	—

A file is no longer something you bring into a document. Until August 2026 the picker could import a file from your machine and staple it to the document you were writing — it belonged to that one document, it had no owner, no code, no version and no approval, and it could not be cited from anywhere else. That door is gone. A file worth citing goes into governance first, as an external document: it gets a code, an owner, editions, a fingerprint and a place in the record, and then you cite it from External documents like anything else. Files brought in the old way still work exactly as they did — their chips resolve, they show the file's name, they carry their dot and their popup, and nothing you have already written has changed. What is gone is the way to make more of them.

Naming a person is no longer something you insert here. Documents written earlier can contain a person chip, and those still render the person's name exactly as they always did — nothing you have already written has changed. But the body of a document was never where a question reached somebody: to ask a colleague something, name them in a comment, which is the surface that actually notifies them. See Comments.

A rolling set is one reference that means a living set. It is never a stored list: its chip shows the set's name and a live member count ("… · 12"), the count is recomputed every time the document opens, and when a check reads it, the set expands to exactly the records it holds at that moment. There is nothing to refresh and nothing to keep in sync.

Registers match on their name and on their code, so typing either finds one — including a code a register used to carry before it was renumbered. Connected apps have no code to match — they answer to their name and to their connector, so the product name finds one you renamed.

Inserting one: the Mention entry

Press / in the body and choose Mention. That is the door — one entry, for pointing at anything. The reference picker opens, and the rest of this page is about what you find there. (Workflow steps are not placed from this palette — the builder composes them; see Workflows in documents.)

The citation block in the document's own details panel — opened, like every other panel, from the buttons at the right of the top bar, see The editor — carries an Add button that opens the same picker, so you never have to leave the panel you are reading to add what it is listing.

Typing @ in the body does nothing. It used to open a menu of its own; it no longer does. It is an ordinary character now, so an email address, a handle or a price in your prose is simply what you wrote. There is one way to cite something, and it is the same screen however you reach it. (@ does mean something in a comment — there it opens a list of your teammates and notifies whoever you choose. See Comments. The distinction is deliberate: the body cites records, a comment names people.)

The raw form, for anyone who writes one by hand

Typing [[ opens a small menu under the caret — the top few of every kind, each under its own heading. That is the raw form a reference takes in the text, and it keeps working for anyone writing one by hand, including its narrowing prefixes: [[sheet: for registers alone, [[doc: for documents alone. You never need it. The picker is the way in.

Each group shows three. That is what makes the menu usable in a workspace with a hundred documents in it: a single ranked list would fill with documents and you would never see a control. Where a kind has rolling sets, they lead its group — the ⊞ rows, each carrying its live member count. When a kind has more, its group ends in a door — "18 more documents →" — which opens the picker, already narrowed to that kind and already carrying what you typed. (In a very large workspace the count reads "40+ more", because past that point the workspace stops counting exactly.)

Escape closes the menu and leaves your typing alone. It never edits what you have written. Until you pick a target, what you typed is just characters — abandoning the menu leaves nothing behind.

The menu answers your keyboard only while you are typing in the document. Click into a comment or the panel beside it and it steps aside; click back into the text and it is waiting where you left it. And in a code block it does not open at all — a reference cannot live inside code.

Inserting one: paste the link

Open the thing you want to cite, copy the address out of your browser's address bar, and paste it into your document. It arrives as a chip, exactly as if you had picked it from the menu.

It works for every kind a document can cite — documents, registers, risk records, controls, connected apps and rolling sets. (A connector address resolves onto the connection in Settings, whether it names the app or, on an older chip, a source inside it.) See Every reference has an address.
Paste it over a selection and you get a link, not a chip, wrapped around the words you selected. That is what pasting a link means everywhere else, and a chip cannot carry your words: its label is the target's own name.
A link from a different workspace never becomes a chip. Its identifiers mean nothing in yours, so it stays an ordinary link — still clickable, still correct, just not a governed reference.
Nothing is looked up while you paste. If the link points at something you cannot open, you get a chip that says so, the same as any other reference to a record outside your reach.

Copying a chip out

Copy a chip and paste it into a chat message, an email or a ticket, and what lands is a link your colleague can open — the record's address, not an internal identifier. Copying between two Alchex documents still carries the full reference, label and all.

The one kind with no address — a file imported into this document — has no link to give, so copying a file chip out still produces its raw form. Pasting it into a different Alchex document is honest rather than helpful: the file stays with its owning document, so the pasted chip reads gone there (see the aliveness section's non-portability note).

Pasting any other link

A web address pasted into the body becomes a link, not a line of characters:

Over selected text, the words stay and become the link. Your sentence is never replaced by a URL.
On its own, the address becomes its own link text. No page title is fetched — your document never quietly asks another website who is reading it.
Ctrl+Shift+V still pastes literal characters, for links and references alike.

A link and a reference are different things and are meant to look different: a reference is a chip that resolves live and can go restricted or retired; a link is a link, and the workspace makes no promises about where it goes.

The reference picker

The slash palette carries exactly one entry for pointing at anything: Mention. It opens this picker — and so do the citation block's Add button and any "more →" door in the [[ menu. Whatever you are citing, and however you got here, it is the same screen. (There are no per-kind palette entries to choose between; the picker's own rail does the narrowing.)

The picker sits on a solid surface over a dimmed page — your document waits behind it, but never shows through it.

Down the left is what you can reference — the categories themselves, in this order: Policies, Procedures, Work instructions, Manuals, External documents, Registers, Controls, Risks and Connectors. It is the same rail on a document and on a control, so the vocabulary does not change with the screen you are on — and since August 2026 neither do the contents: every category is a workspace-wide search, scoped to the teams you can read.

External documents sits with the other document types, and that is the point. An external document is not a different kind of citation — it is the same reference a policy gets, pointing at a governance record that happens to be a file rather than text you wrote. So it is a document category among the document categories, not a filing cabinet beside them.

There is no "Everything" row. You are always in a category. The picker opens on the first category that has anything in it, so it never greets you with an empty list, and the rail row you landed on is lit so you can see where you are. Arriving through a door in the [[ menu, the category is chosen to match what you were pointing at, and your search is already in the box. The search box has focus when the picker opens, so you can start typing immediately; ↑ and ↓ move through the results and Enter picks one, without leaving the box.

Typing searches the category you are in, and only that one. If a word matches nothing here you get this category's empty state, rather than being slid into another category mid-word — move the rail yourself when you want to look somewhere else. It is the same promise the search box makes in words: it says Search procedures…, and that is exactly what it does.

Documents you already have of an older type — a Form, a Record, or a plain Document — are still fully referenceable: their chips resolve, they open, and searching still finds them by name or code. What they do not have is a category of their own, because those types can no longer be created — so the picker's rail cannot browse to them. Reach them by typing their name in a category that holds documents, or from wherever they are already cited.

Connectors has a row of its own, on both screens. For a while it did not: an Evidence row stood there instead, listing a separate record kind that sat between your sentence and the system it meant. That record retired in September 2026, and the row now lists the sources themselves — the same sources a workflow reads and a control's audit is graded against, so what a sentence cites and what a check fetches are one thing.

A category shows only what it is named after — nothing else ever appears there. Pick Procedures and you get procedures: no policies, no registers, no controls, and no heading for any of them. Categories that cover a whole kind — registers, controls, risks — lead with a few of their rolling sets: the ⊞ rows, each reading as what it is ("… — all documents · 36 members, live"), and then their records, which stay in view rather than below a directory of every set. A single-type category such as Procedures has no ⊞ rows, because a rolling set covers a whole kind and there is no such thing as "all procedures in team Security". External documents lists the file-backed records in governance, and only those: a record is external because of how it arrived, not because of what somebody typed in a field, so an uploaded PDF appears here whatever its type once said — and it appears here instead of under Policies rather than in both. That is the same rule the Governance list follows and the same rule that gives it an EXT- code. Connectors lists your workspace's connected apps by name, each showing its connector and the account it runs as, and each with a coloured dot for whether it is answering. A document you attached to a control is not offered here: the attachment leaves a pointer behind it, and citing that pointer when you mean the document would put the same thing in your text twice. Cite the document, under its own type.

Narrowing happens before the results are counted, not after: the "N results" line and the [[ menu's "more →" counts always describe the list you are looking at.

Team scope. When you can read more than one team, a quiet selector beside the search narrows the picker to one team's records — its documents, external documents, registers, controls, risks and rolling sets; a team's sets are the only ⊞ rows offered while it is selected. On a workspace where you can read only one team the selector does not exist: there is nothing to choose. The selector only ever offers teams you can already read — it is a view filter, never a way to see further.

Connectors is the one row it does NOT narrow, and that is deliberate: a connection is workspace-wide, so narrowing to Security would hide apps Security can perfectly well name.

There are no headings. Every list belongs to one category, and the rail already says which — a heading could only repeat it. (They used to exist to keep the mixed view readable; the mixed view is gone, so they went with it.)

Connectors: cite the system itself

A connector reference points at one of the apps you have connected — by the name you gave it, with its connector and account underneath and a dot for whether it is answering.

The Connectors row lists them all, and the chip you insert opens the app on the Connections page. Typing narrows on the name and on the connector, so the product name still finds a connection somebody renamed. Unlike every other row, the team selector does not narrow it: a connection is workspace-wide.

The row finds; it does not make. There is no door here that reaches into a connected app — connecting one is done in Settings, where the credential and the permissions live, and everything you have connected is already citable.

A chip written before September 2026 points at a narrower thing — one folder or list inside an app — and keeps working exactly as it did. See Connectors as references.

Pick many, insert once

Clicking a row picks it — an accent bar marks it — and clicking again unpicks. Picks accumulate as you move between sections, and the one button in the footer counts them live: Insert 3 references. Each pick lands as its own chip, in the order you picked, exactly as if you had inserted them one by one. Picking two documents and a rolling set inserts three chips.

Every chip reads the record's own name, and there is nothing to type. The picker used to carry a Display text box, so a chip could be made to say anything you liked — including, a month later, the old name of a record somebody had since renamed. A reference is a pointer at a record, and the honest thing for it to show is what that record is called, so the box is gone. Rename the record and every chip citing it follows on the next open. (This is what the chips already did whenever the record answered; the box only ever mattered when it disagreed.)

Each result reads as the record it is — its kind, its name, its code, and one line of context (how many confirmed records a register holds, whether a control has any evidence yet, when a document was last touched). A register's count here means the same thing its dot does: rows somebody has vouched for. Proposals waiting to be accepted are not counted, so a register full of suggestions and nothing confirmed reads 0 records and shows red — the same answer you get on the register itself. A coloured dot marks anything that needs attention: a register nobody has filled in, a control with no evidence, a connected source that stopped answering.

Ordered by how well it matches

Within a category, results are ranked as one list: whatever matches your typing best is first, and nothing is ever promoted or held back for being a particular record.

(The [[ menu is the other way round — a few of each kind, always — because its job is to put every kind within reach in a small space. Here you have the whole screen and a rail, so ranking can be the only thing deciding the order.)

What counts as a better match, strongest first:

Its code is exactly what you typed — type a code and you get that record, top of the list. A code identifies one record and only one: each kind carries a prefix nothing else uses (PLC-, PRC-, INS-, MAN-, CTL-, LIST-, EVD-, and EXT- for an uploaded file), and codes are unique inside a workspace, so an exact code match is never ambiguous.
Its name is exactly what you typed.
Its code, then its name, starts with what you typed.
A word in its name starts with what you typed.
What you typed appears anywhere in its code, then anywhere in its name.
Only the thing it lives inside matched — a table found because you searched for its register.

Where two results match equally well, the one touched most recently comes first. What you type is taken literally: % and _ are characters, not wildcards.

Before you type anything, the list shows what your workspace touched most recently. That is the state most uses start from, and it means the picker is useful without knowing the answer in advance.

Referencing one table inside a register

A register holds one or more tables, and often the thing your sentence means is one of them — the supplier contacts, not the whole supplier register. Tables appear in the picker in their own right, each shown with the register it belongs to, so two tables with the same name in different registers are told apart at a glance.

Searching a register's name finds the tables inside it as well as the register itself. Those come below anything that matched on its own name, because a match on the thing you searched for is a better answer than a match on its container.

You see a table only if you can see the register it lives in. There is no separate permission for a table: retire the register, or move it to a team you are not on, and its tables leave your picker with it.

At the bottom, before you commit, you see exactly what will land in your sentence — the chip as it will read, and the reference behind it.

Below a divider on the left is the door that brings something new into existence:

The picker lists every connected app you have, including the ones that are not working. An app that cannot be read right now is shown greyed out with the reason on the row — Sentry (Playtest) — needs reconnect, Google Drive — disconnected — and cannot be picked, with one line under the list pointing you at Settings → Connections to fix it. It used to be left out of the list entirely, so a workspace with two connected apps was told No connected apps: an answer that was untrue and that named nothing you could do about it. No connected apps now means exactly that — you have not connected one yet.

There is no Import-a-file door, and there is no Attachments category for one to fill. Bringing a file into the record is the Governance page's job — drop it there, it becomes an external document with a code and an owner, and it is citable from every document in its team rather than from the one you happened to be typing in.

Nothing is created until Save. Cancel the picker and the workspace is exactly as it was — nothing stray is left behind.

You can only reference records in the teams you belong to, so two colleagues on different teams see different things in the picker. Connectors is the exception: a connection belongs to the workspace, so everyone sees the same apps there. See Permissions.

The picker follows the team you are in

If you have a team selected in the sidebar, the picker offers that team's records — its documents, external documents, registers, controls, risks, rolling sets and connected sources — and nothing from your other teams. On All teams it offers everything you can see. This is the same team you are filtering the rest of the app by, so what you can cite matches what you are looking at.

It is a view filter, never a way to reach further: selecting a team can only narrow what you already had access to. A team you do not belong to is simply ignored, and you get your usual list rather than an error.

Chips you have already inserted ignore it. A reference in the text resolves against everything you may see, whatever the sidebar is filtered to — so a document that cites a record in another of your own teams keeps reading normally instead of turning into a restricted record because of how you happened to be browsing. Filtering changes what you can find; it never changes what a document says.

The same team rule holds for a reference that names a whole rolling set of records at once — a team's documents, say, cited as one reference in a control's instructions rather than record by record. A set is never a stored list: it expands to whatever its team holds at the moment somebody reads or audits it, and to a reader outside that team the reference reads as a restricted record, so neither the set's name nor its members travel. How an audit uses one is described in Controls and evidence.

The same picker opens on a control's page — its definition is a document like any other, so referencing works exactly as it does here, with the same rail and the same categories. One thing is scoped to the control rather than the document: connecting a resource also attaches that connection to the control as a source, so the control's agent is allowed to read from it.

Every reference has an address

Everything you can reference also has a web address — a link you can copy from the browser bar, paste into an email, a ticket, or a chat message, and expect to work. A link either opens the record or it doesn't; it can never quietly mean something else.

Clicking a chip takes you to that address:

Document and register chips open the record's own page, and risk references open the risk record.
An action chip opens its step's panel on the record it belongs to. An action has no page of its own — it lives inside a record — so its address is that record plus the step, and both halves are checked when the chip resolves: one that pairs a step with the wrong record shows nothing rather than the wrong step.
A control chip opens the control — its definition is a document, so the address lands you in the same editor its page uses.
A connector chip opens the app on the Connections page. An older chip, pointing at a source inside an app, lands on the same page — the connection that source hangs off.
A connection label chip opens the connection it hangs off, on the Settings → Connections page. A label owned by a team you are not on gives you the plain "not available" page instead — the same answer an address that no longer exists gives, and for the same reason.
A rolling-set reference opens the list its records live in.

If an address points at something that has been removed — or something that is not yours to see — you get a plain "not available" page. The two cases look identical on purpose: an address is never a way to find out whether something exists.

A mangled address gets the same page, and that is a third case rather than a restatement of the first two: a link truncated by an email client, a broken paste, a character dropped from the end. It cannot name anything, so it is answered as nothing found — not as a fault.

In the assistant's answers, these addresses render as the same chips you see in a document, so a record the assistant cites is one click away — see AI review and assistance.

How a chip stays live

When you open a document, every chip on the page resolves at once:

Document chips resolve the exact documents referenced, by id, and show the document's current name. Rename the target and the chip follows on the next open.
Register chips resolve the exact registers referenced, by id.
Connector chips resolve the exact connection referenced, by id — or, on a chip written before September 2026, the source it names.
Control chips resolve the exact controls referenced, by id, and show the control's current name.
Rolling set (⊞) chips resolve the exact sets referenced, by id, and read their member count fresh — the count is never stored, so what the chip says is what the set holds right now.
File and connection label chips render from the label stored on the chip.

Every kind resolves as one lookup for the whole page, however many chips of that kind it holds — a document citing twenty registers costs the same one request as a document citing one, and the lookup asks for exactly the records you cited rather than reading everything you have access to. Nothing is held over from a previous open, so a rename or a newly added record shows up the next time the document opens, without waiting for anything to expire.

This happens on the copy the document opens with, which is also the copy you type into — there is no connecting step between reading a chip and editing one. Following a reference, opening its popup and double-clicking to change it are all available from the first moment the document is on screen.

A reference is also a backing

Referencing something that proves a claim does two things at once, from one act of writing.

The chip appears in your sentence, and the item appears under Backed by on the document's panel — the list of what this document rests on. You do not attach it separately; writing the reference is the attachment.

Take the reference out of the text and the backing is withdrawn from the list. The item itself is untouched and stays in the workspace, because dropping a citation from one document says nothing about whether it is still worth holding — and the same item may back several documents.
Anything attached to the document by hand somewhere else is left alone. Editing the text never quietly undoes a deliberate act.
A reference to an item that has been retired or deleted adds no backing. The chip picks up a red dot — still wearing the item's title — and the list agrees with it, rather than inventing a source.

A document that references nothing says so: Backs nothing yet — unproven. An empty list is a finding, not a blank.

A register reference

A register chip is the strongest citation you can write, because a register is where you record that you actually did the thing. Citing one works exactly like citing a connected source — the chip appears in your sentence and the register appears under Backed by, from the one act of writing. See Registers.

A register chip carries the same aliveness dot as every other chip, and only that: green while the register is there, red once it has been archived — a document citing a retired register is claiming something that is no longer true, and it should say so rather than look fine. Whether the register currently proves anything — whether it holds confirmed records or sits empty — is a fact about its content, and it lives where the content lives: on the register's own page, in the governance list, and under Backed by in the citing document's details panel. The chip used to carry a second coloured dot for it; two dots racing on one chip said less than either alone.

Click a chip and the record answers for itself, in place: a small popup with the record's current name, one status line, and its facts — where it came from, when and by whom it was added, and a content hash where one exists.

A file chip's popup — one from before August 2026, since no new ones are made — leads with Team, the team the file belongs to, which is the team of the record it was brought into, and then Uploaded, with the date and the person. Team first because it is the fact that decides whether you can act on the file at all, and nothing else in that popup answers it. A file whose record is on no team shows no Team row rather than an invented one.

The popup's footer carries the kind's quiet actions. Open › goes to the record's own page — for a connector chip, to its label on the connection it reads through. Rebind › points this chip at a different record: it opens the reference picker on the chip you clicked, so the sentence keeps its shape and only its target moves. A ⊞ collection chip's popup lists the set's current members, computed the moment you open it; the count is never a stored copy.

Rebind is offered even when the record cannot be described at all. A popup that reads This record is no longer available — or Couldn't load this record — carries Rebind and nothing else, because that is precisely the chip somebody is looking at in order to repair it. A popup that states a problem and offers no way out of it is a dead end at the one moment you are staring straight at it.

It appears only where re-pointing is possible — an editable draft. A reader is never offered a repair they cannot make, so a read-only view — an approved version being read, or an archived document — shows the popup without it.

A record you may not see never opens a popup — a restricted chip stays silent rather than becoming a way to probe it.

The citation block in the details panel

The document's details card — one press away in the document's top bar — carries the whole citation picture as one block:

Backed by — the incoming proof: every record backing this document, each row wearing the record's or label's own name (a connected-data proof reads as its label — the connector brand is provenance, never the title), a status dot for freshness, and "also backs N others" where a proof is shared. The section appears only when something actually backs the document.
Cites — the outgoing references, live from the text, grouped by kind with counts; ⊞ collections carry their live member count. Each row wears the same aliveness dot its chip does — green for alive, amber for a source out of reach, red for a target that is gone — so the panel is where you find the two citations that need attention without reading the page.

Rows navigate: clicking one scrolls the text to its chip and opens that chip's popup — the popup stays the one management surface, and the panel stays navigation and status. Names resolve live the way chips do, and a reference whose target no longer exists says so instead of showing a healthy-looking name.

The block's head carries Add, which opens the reference picker with your caret left exactly where it was — nothing is written into your prose on the way. It is a shortcut to the one way of citing something, never a second one, and it appears only while the document is editable.

Editing, rebinding and removing

Rebind is the one word for pointing a reference somewhere else, and it means the same thing everywhere it appears — on a chip's popup and in the reference picker it opens. Nothing calls it Replace, and nothing makes you discover it by double-clicking and hoping.

Two gestures open the same door. Click the chip and choose Rebind › (see The chip popup), or double-click the chip — while the draft is editable, either way — and the picker reopens on that chip: the same screen that created it, showing what it points at now.

A document, register or control chip opens the picker with its own kind selected, so you can point it somewhere else or just change how it reads.
A file chip from before August 2026 opens the picker too, so a citation of a file can be re-pointed at something that is still citable — the external document that replaced it, most likely. There is no replace-the-file row any more, because there is no way to bring a new file in here.
A connector chip's form shows which connection the label reads through and the resource it is bound to. There is nothing to type: the chip wears the label's own name, and re-pointing the sentence means picking a different label.

A single click opens the chip's popup (see The chip popup); following the chip to its target is the popup's Open ›, so a click can never yank you off the page you were reading.

To remove a chip, delete it like text. It behaves as a single unit — one backspace takes the whole chip, not the last letter of its label.

Copying a chip into another document carries the reference with it — and only the reference. A pasted chip never grants anything by itself: a control earns the right to read from a connected system through its own reference form (pin, check, save), not through what happened to be on the clipboard.

Paste that same chip somewhere outside Alchex and what lands is a link, not a reference — see Copying a chip out.

The aliveness dot

Every chip leads with a small dot that says how its target is doing, the moment the page resolves. The dot is always on — including the good news: a green dot is a verified fact, which a bare chip could never state.

A chip has three states, and the difference between the second and the third is the whole point: one is about whether the record exists, the other about whether its source is healthy.

State	The dot	What it means	What you should do
Alive	green dot	The record is there and, where it has a health check, the last check passed.	Nothing.
Unreachable	amber dot	The record is still there, but something behind it could not be reached right now — a connector that is down, a binding nothing has verified, a check that is failing, a proof expiring or already expired. The citation is still valid; only its freshness is in doubt.	Fix the source, not the sentence.
Gone	red dot	The record has been archived — retired, but still there to be named. Red means gone, and nothing else.	Rebind the chip, or take it out.

A record that was deleted outright is the one case this table cannot cover, and it is worth knowing why: a deleted record cannot be read, so nothing can tell your reader whether it was destroyed or simply belongs to a team they are not on. Its chip therefore takes the restricted-record form — inactive, with no name and no dot — rather than a red one. Retiring what people cite, and deleting only what nobody did, is what keeps a red named chip the answer they get.

A chip whose target has not answered yet — the first instant of a page, or a kind nothing can verify — shows no dot rather than a hopeful green one. A dot is a measurement, never a guess.

The dot is not the only signal, on purpose. The chip's underline changes with it — dashed for a record that is gone, dotted for a source that could not be reached — so the difference survives a colour-blind reader and a black-and-white printout. Those two, and the wording you get on hover, are the whole vocabulary: the chip used to say a single state four ways at once, and four weak marks read as noise rather than as a signal.

A chip with a red dot keeps the record's name. That is deliberate: you cannot choose a replacement for something you can no longer name, and the name is the only thing telling you which of a page's chips is the broken one. Hovering it says so in words — … has been removed — this citation no longer resolves. Click the chip and choose Rebind to point it at a live record. Clicking it opens the popup, which reads Archived and carries Rebind ›.

An amber dot says the opposite, and says it plainly — the record is still here, but its source could not be reached. Amber is deliberately not red: a connector that is down for an hour used to render exactly like a deletion, and authors spent their time rebinding citations that had never broken.

Which kinds reach which state:

Document, register, a table in a register, control and risk chips are green or red, never amber. There is no such thing as an unreachable document: those kinds have no source behind them, so they either exist or they do not.
Connector chips reach all three — green, amber, or red. Amber is reach: the label's last verdict was unreachable or its connection is disconnected. Red is a label that is gone.
Connected-system chips are green or amber, never red. Amber appears only when the label's last check confirmed the source unreachable or its connection disconnected — an unverified label stays quiet-green on existence alone, because "nobody has checked" is not "it is broken". The chip never goes red from the label side: removal is reported by the removal itself (see Remove above).
A rolling set (⊞) is green whenever it resolves. It is a live query rather than a stored list — a set holding nothing resolves to a count of zero, which is an answer, not a failure. A set outside your teams reads as restricted, like any other kind.
File chips are green or red inside their own document — the existence read is the document's own file list, so the dot is a real measurement: green while the file is there (wearing its current name), red once it is removed. Two honest limits: in chat and previews a file chip stays undotted (no owner in sight, no claim made), and a file chip is non-portable — a file belongs to one document, so the same chip pasted into another document reads gone there rather than borrowing a life it does not have.

A green answer has a shelf life. "Alive" is a measurement with a timestamp, not a property: a verify older than seven days stops counting as verified, and the label reads as unverified again — quietly, never as an alarm — until something checks it. A confirmed failure does not age out the same way: the source was observed dead, and it stays flagged until a check observes otherwise.

Restricted is a fourth thing, and separate

A document, register, control, risk or connector chip pointing at something outside the teams you belong to renders as a restricted record: no name, no identifier, no kind, no colour. The same document can show a colleague on that team a healthy, named chip and show you this. A record that no longer exists anywhere reads the same way, because telling those two apart would itself say something about a record you are not entitled to know about.

It is a display decision, taken each time the document is opened. Nothing is rewritten: your colleague's copy still reads normally, and if you are later given access the name appears.

Being retired is not the same as being restricted, and it used to be treated as if it were. Archiving a record silently rewrote every past citation of it — in documents and in the assistant's past answers — into "a restricted record", so a reader was told they lacked permission when what had actually happened was that their own team retired the record. An answer written in March changed its words in August. A retired record's citation now keeps its name and goes red, in documents and in chat transcripts alike. The restricted wording is left to the two cases that genuinely cannot be told apart: a record on a team you are not on, and one that has been deleted outright.

If a connection is disconnected or its access expired, chips pointing at its labels still render; what breaks is the record fetch behind them. Reconnect from the connections page. See Controls and evidence.

The assistant reads your chips

A chip is part of the document's text to the AI, not decoration around it. When the assistant reads a document — to answer a question about it, to propose an edit, or to check a requirement against it — every reference arrives as the record it names, with its address, so "backed by [Q3 access review]" is a fact it can follow rather than a gap in the sentence. A check resolves the connected sources the text actually cites; what it finds there is graded like any other evidence.

Where references show up later

Downloading a file — from the details panel's files list, or from Download in a file chip's popup — opens it in a new tab under the name it arrived with. The link is fetched fresh at the moment you click and is short-lived by design, so nothing you leave open on screen keeps a working link to the file.

References are part of the document body, so they travel with it: into the copy sent for review, into the published version, into version comparisons, and into exports. A reviewer comparing two versions sees a re-pointed chip as a change like any other. See Versions and history. A reviewer who wants to question one says so in the document's Comments panel, quoting the passage that carries it.

A citation is also part of what search and the assistant read. A chip is not a picture sitting in the text — the thing it names is indexed with the words around it, so a document that cites your access-review register is found by searching for that register, and the assistant answering a question about it can see the citation is there. What is indexed is the reference's name, not its internal id: an identifier nobody would ever type is noise in a search index, and the name is what a person is actually looking for.

The assistant reads the citation in a form it can also write back. When it rewrites a paragraph that cites something, the citation survives the rewrite pointing at the same record — it is not flattened into ordinary words that merely look like a name. This holds for every kind of reference in the table above, and for a chip written in any of the older forms the editor has used over time: they all reach the assistant as the same one address, so none of them is the odd one out that quietly goes missing.

That last point is worth stating plainly, because it has not always been true. Until August 2026 the assistant could only see two of the older chip forms; every other citation reached it as a blank, and a rewrite of that paragraph handed back text with the citation gone — no warning, because from where the assistant sat there had never been one there. If you have a document that lost a chip during an AI edit before then, the chip is not recoverable from the rewrite itself; the version history holds the paragraph as it was, so restore it from there. See Versions and history.

You do not need a saved version to have been made at the right moment for this. The history also lists the editing session the rewrite happened in — the assistant's passes are recorded separately from a person's — so you can return the draft to how it stood immediately before it and take the paragraph back from there.

It also rewrites as little as it can. Asked to change one sentence, it proposes a change to that paragraph alone, so citations in the paragraphs around it are not touched at all — see Which parts it can change. The way it addresses those parts is kept out of the document's words: what search and the assistant read is your text and the names you cited, never the internal identities of the paragraphs holding them.

Citing something does not freeze it. A reference is not a lock: the record you point at can still be retired, by you or by anyone else who may retire it, and nothing refuses on your citation's account. What you get instead is that the citation tells the truth about it — the chip picks up a red dot where the sentence is written, keeps the record's name so you can see what you lost, and carries Rebind for pointing that sentence at a live record. Restoring the record clears the dot. So the commitment runs one way and it is yours: to notice a red dot and repair it. See Activity and archive for how removal works now.

A reference is a link from your text; a document's scope is the reverse tie — the clauses of your standard the document declares it covers. Scope is edited from the document or attached from the compliance record, and every change to it is logged on that record's activity ledger. See The compliance record.