Attachment scanning
Check files sent with a model request before they reach the provider. The gateway extracts document text, reads text in images and scanned PDFs with OCR, and identifies image risks such as payment cards or ID documents. Your enabled data risks decide what to monitor, remove or block.
Attachment scanning is off by default. Turning it on does not change what the selected model can accept: the file format must still be supported by that model.
Three kinds of protection
OCR and image classification answer different questions. An invoice containing a card number can trigger a text detection without being a Payment Card Image. A photo of a payment card can trigger that image type. Enable the protections your use case needs.
Where to configure it
The app's Attachments section has Scan attachments, Allowed files and limits, Scanning, and Images and OCR. Changes apply after Save settings. Select the data types and their actions in the app's Security Guardrails section; attachment text uses the enabled request-side detections.
When the Policy Engine is on, configure the Attachments card under Govern > Policy Engine > LLM Gateway. The Data & Adversarial Risks card selects the text and image data types and their actions. Changes join the shared draft and apply after you publish a revision. A saved app switch does not override the published policy.
Turn on attachment scanning and Classify images, then enable at least one Image Risks type in Security Guardrails, or select that image data type in a Policy Engine detection rule. Classify images on its own does not check every image type.
Allowed files and limits
File types are detected from their content, rather than trusting the file name. Each type can be Allow, Strip or Block. Allow lets the file proceed to the enabled scans; it does not exempt it from data-risk rules.
Files resent in conversation history still count toward size limits and remain subject to type and page checks. Their content can still be scanned.
Content the gateway can read
Audio, video, archives and unknown binary formats are not content-scanned. Their file-type controls still let you allow, remove or block them. Allowing a type does not make its content readable.
Document text and OCR
Extract document text is on by default once scanning is enabled. The extracted text is checked with the request's enabled text data types, including applicable custom detections.
OCR reads up to 20 pages per file, separately from the configurable Max PDF pages limit. Across a request, up to 50,000 extracted characters are sent to text detection. If work cannot finish or text remains beyond the scan limit, the scan is reported as incomplete; findings from the part that was scanned still apply.
OCR scripts
OCR scripts defaults to Every script. Choose Only these to limit the writing systems read:
These are writing systems, rather than a guarantee for every language or image. Bengali OCR is not supported. Text in an unsupported or excluded script, unreadable text, or text made too small by resizing can result in a partial scan.
Image Risks
Classify images checks the visual content of raster images attached to requests. It is on by default within the attachment settings, but runs only while attachment scanning is on and an image type is enabled. Image Risks is off by default.
Each image type can use its own action or inherit the Image Risks category action. Start with Monitor to review findings before choosing Strip or Block. Classification describes visible content; it does not verify a person's identity, authenticate a document, or make a medical diagnosis.
Image classification applies to attached raster images. It does not inspect images embedded inside a PDF or Office document. OCR can still read scanned PDF pages. Image quality, cropping and small content can affect what is detected.
Quick configurations
The same choices can be scoped to people, groups or applications on the Policy Engine cards. Publish the draft before testing live traffic.
Actions and unreadable files
Redact and Partial redact findings in an attachment currently remove the entire attachment. The gateway does not rewrite a PDF or Office file, obscure pixels in an image, or replace a document with redacted extracted text. Where the client format cannot safely represent a removed attachment, a Strip decision becomes Block.
Two additional controls handle content the gateway cannot read:
The gateway does not fetch remote URLs or download files from a provider's file store. Send file content with the request to have it scanned. Choosing Block for unreadable attachments can reject those references instead.
Timeouts, scanner failures and unfinished scans fail open: the missing scan alone does not remove a file or reject a request. This behavior is separate from the action for an unreadable file. Findings in content that was successfully scanned can still trigger their configured action.
Coverage and availability
Scanning applies to request attachments, including requests that ask for a streaming response, on Chat Completions, OpenAI Responses, Anthropic Messages, Gemini generateContent, Bedrock Converse and supported InvokeModel bodies. It also applies to supported attachments sent through SDK Mode. The gateway inspects the incoming client format before any format translation.
It does not scan files generated in a model's response. Enabling scanning also does not fetch files held remotely, inspect audio or video content, or add guardrails to the separate endpoint-family routes.
On no-GPU deployments, document text extraction remains available; OCR and image classification are unavailable. A requested scan that cannot run is reported as incomplete and fails open. This differs from an image intentionally left unscanned because its protection is switched off.
Review scan outcomes
The gateway's Insights > Attachments view shows file kinds and sizes, scan outcomes, data found in attachment text, Image labels, and Why attachments were skipped. Filter the period and applications, then select a chart or app to review the related requests.
Request details show each attachment's scan status and the resulting action. Check for incomplete or skipped scans as well as detections; a successful model response alone does not establish that the attachment was scanned.
Related
- Security guardrails - request-side text and image data types and their actions.
- Custom detections - your own sensitive text definitions.
- Policy Engine overview - scoped attachment controls and detection rules.
- Author, simulate and publish - making policy changes live.