References

A reference is an inline chip in your text that points at something else in the workspace. A chip is a dot and a name: every chip wears the same quiet neutral, whatever kind of thing it points at, and the one colour on it is the aliveness dot — green when the target is verified alive, amber when its source cannot be reached, red when it is gone. What kind of thing a chip points at is one hover away, and one click opens its popup. Unlike typing a name by hand, a chip resolves against live data every time the document is opened — so it shows the target's current name, and it tells the reader when the target is gone. Use one whenever a procedure names another document, or a system you pull records from.

Datasets count towards your storage

A dataset you upload to reference — and the files imported into a document — are files your workspace keeps, so they count towards its storage limit. An upload that would take you past it is refused before the file is stored, leaving your usage unchanged; removing a dataset gives the space back. See Seats and licences.

The kinds

A file is no longer something you bring into a document. Until August 2026 the reference picker could import a file from your machine and staple it to the document you were writing — it belonged to that one document, it had no owner, no code, no version and no approval, and it could not be cited from anywhere else. That door is gone. A file worth citing goes into governance first, as an external document: it gets a code, an owner, editions, a fingerprint and a place in the record, and then you cite it like anything else. Files brought in the old way still work exactly as they did — their chips resolve, they show the file's name, they carry their dot and their popup, and nothing you have already written has changed. What is gone is the way to make more of them.

Naming a person is no longer something you insert here. Documents written earlier can contain a person chip, and those still render the person's name exactly as they always did — nothing you have already written has changed. But the body of a document was never where a question reached somebody: to ask a colleague something, name them in a comment, which is the surface that actually notifies them. See Comments.

A rolling set is one reference that means a living set. It is never a stored list: its chip shows the set's name and a live member count ("… · 12"), the count is recomputed every time the document opens, and when a check reads it, the set expands to exactly the records it holds at that moment. There is nothing to refresh and nothing to keep in sync.

Registers match on their name and on their code, so typing either finds one — including a code a register used to carry before it was renumbered. Connected apps have no code to match — they answer to their name and to their connector, so the product name finds one you renamed.

Inserting one: type @

Type @ in the body and a small menu opens under the caret with the records you can cite. Pick one and it lands as a chip. There is no dialog: the menu and pasting a link are the two ways in. (Until October 2026 a Mention entry in the / palette opened a large reference picker; it is gone, and so is the details panel's Add button that opened it.)

@ opens the menu only at the start of a line or after a space or an opening bracket. Inside a word it is an ordinary character, so an email address like deniz@example.com is simply what you wrote. A space straight after @ closes the menu too. (In a comment, @ opens a list of your teammates and notifies whoever you choose instead. See Comments. The body cites records; a comment names people.)

The document still stores each citation the way it always has, so documents written with the older [[ menu need nothing done to them.

The @ menu

The menu shows the top few of every kind, each under its own heading. Everything you type after @ is the search, spaces included.

Each group shows three. That is what makes the menu usable in a workspace with a hundred documents in it: a single ranked list would fill with documents and you would never see a risk. Where a kind has rolling sets, they lead its group — the ⊞ rows, each carrying its live member count. To reach a record further down a group, keep typing: the menu narrows to what matches.

Escape closes the menu and leaves your typing alone. It never edits what you have written. Until you pick a target, what you typed is just characters — abandoning the menu leaves nothing behind.

The menu answers your keyboard only while you are typing in the document. Click into a comment or the panel beside it and it steps aside; click back into the text and it is waiting where you left it. And in a code block it does not open at all — a reference cannot live inside code.

Inserting one: paste the link

Open the thing you want to cite, copy the address out of your browser's address bar, and paste it into your document. It arrives as a chip, exactly as if you had picked it from the menu.

• It works for every kind a document can cite — documents, registers, risk records, connected apps and rolling sets. (A connector address resolves onto the connection in Settings, whether it names the app or, on an older chip, a source inside it.) See Every reference has an address.
• Paste it over a selection and you get a plain link, not a chip, wrapped around the words you selected. That is the simplest way to point one document at another in your own words: select the words, paste the address. A chip cannot carry your words: its label is the target's own name.
• A link from a different workspace never becomes a chip. Its identifiers mean nothing in yours, so it stays an ordinary link — still clickable, still correct, just not a governed reference.
• Nothing is looked up while you paste. If the link points at something you cannot open, you get a chip that says so, the same as any other reference to a record outside your reach.

Copying a chip out

Copy a chip and paste it into a chat message, an email or a ticket, and what lands is a link your colleague can open — the record's address, not an internal identifier. Copying between two Alchex documents still carries the full reference, label and all.

The one kind with no address — a file imported into this document — has no link to give, so copying a file chip out still produces its raw form. Pasting it into a different Alchex document is honest rather than helpful: the file stays with its owning document, so the pasted chip reads gone there (see the aliveness section's non-portability note).

Pasting any other link

A web address pasted into the body becomes a link, not a line of characters:

• Over selected text, the words stay and become the link. Your sentence is never replaced by a URL.
• On its own, the address becomes its own link text. No page title is fetched — your document never quietly asks another website who is reading it.
• Ctrl+Shift+V still pastes literal characters, for links and references alike.

A link and a reference are different things and are meant to look different: a reference is a chip that resolves live and can go restricted or retired; a link is a link, and the workspace makes no promises about where it goes.

The AI checks your links

A web link in a document is a source, like a citation. When the AI reviews the document, it gets the document's links as a list and opens each one it relies on, then says whether the page supports what your text cites it for. A link to a PDF, such as a regulator's published standard, is read the same way. A link it cannot open (a page behind a login, a private address, a scanned PDF with no text, a file that is neither a web page nor a PDF) is reported as unchecked, never as proof. Only public pages are opened, one at a time, and the page's text is read as data: nothing written on it can instruct the AI.

Every reference has an address

Everything you can reference also has a web address — a link you can copy from the browser bar, paste into an email, a ticket, or a chat message, and expect to work. A link either opens the record or it doesn't; it can never quietly mean something else.

Clicking a chip takes you to that address:

• Document and register chips open the record's own page, and risk references open the risk record.
• An action chip opens its step's panel on the record it belongs to. An action has no page of its own — it lives inside a record — so its address is that record plus the step, and both halves are checked when the chip resolves: one that pairs a step with the wrong record shows nothing rather than the wrong step.
• A connector chip opens the app on the Connections page. An older chip, pointing at a source inside an app, lands on the same page — the connection that source hangs off.
• An older connection label chip opens nothing: labels are retired, so it gives the plain "not available" page. Replace it with a chip citing the connection.
• A rolling-set reference opens the list its records live in.

If an address points at something that has been removed — or something that is not yours to see — you get a plain "not available" page. The two cases look identical on purpose: an address is never a way to find out whether something exists.

A mangled address gets the same page, and that is a third case rather than a restatement of the first two: a link truncated by an email client, a broken paste, a character dropped from the end. It cannot name anything, so it is answered as nothing found — not as a fault.

In the assistant's answers, these addresses render as the same chips you see in a document, so a record the assistant cites is one click away — see AI review and assistance.

How a chip stays live

When you open a document, every chip on the page resolves at once:

• Document chips resolve the exact documents referenced, by id, and show the document's current name. Rename the target and the chip follows on the next open.
• Register chips resolve the exact registers referenced, by id.
• Connector chips resolve the exact connection referenced, by id — or, on a chip written before September 2026, the source it names.
• Rolling set (⊞) chips resolve the exact sets referenced, by id, and read their member count fresh — the count is never stored, so what the chip says is what the set holds right now.
• File and connection label chips render from the label stored on the chip.

Every kind resolves as one lookup for the whole page, however many chips of that kind it holds — a document citing twenty registers costs the same one request as a document citing one, and the lookup asks for exactly the records you cited rather than reading everything you have access to. Nothing is held over from a previous open, so a rename or a newly added record shows up the next time the document opens, without waiting for anything to expire.

This happens on the copy the document opens with, which is also the copy you type into — there is no connecting step between reading a chip and editing one. Following a reference, opening its popup and double-clicking to change it are all available from the first moment the document is on screen.

A reference is also a backing

Referencing something that proves a claim does two things at once, from one act of writing.

The chip appears in your sentence, and the item appears under Backed by on the document's panel — the list of what this document rests on. You do not attach it separately; writing the reference is the attachment.

• Take the reference out of the text and the backing is withdrawn from the list. The item itself is untouched and stays in the workspace, because dropping a citation from one document says nothing about whether it is still worth holding — and the same item may back several documents.
• Anything attached to the document by hand somewhere else is left alone. Editing the text never quietly undoes a deliberate act.
• A reference to an item that has been retired or deleted adds no backing. The chip picks up a red dot — still wearing the item's title — and the list agrees with it, rather than inventing a source.

A document that references nothing says so: Backs nothing yet — unproven. An empty list is a finding, not a blank.

A register reference

A register chip is the strongest citation you can write, because a register is where you record that you actually did the thing. Citing one works exactly like citing a connected source — the chip appears in your sentence and the register appears under Backed by, from the one act of writing. See Registers.

A register chip carries the same aliveness dot as every other chip, and only that: green while the register is there, red once it has been archived — a document citing a retired register is claiming something that is no longer true, and it should say so rather than look fine. Whether the register currently proves anything — whether it holds confirmed records or sits empty — is a fact about its content, and it lives where the content lives: on the register's own page, in the governance list, and under Backed by in the citing document's details panel. The chip used to carry a second coloured dot for it; two dots racing on one chip said less than either alone.

The chip popup

Click a chip and the record answers for itself, in place: a small popup with the record's current name, one status line, and its facts — where it came from, when and by whom it was added, and a content hash where one exists.

A file chip's popup — one from before August 2026, since no new ones are made — leads with Team, the team the file belongs to, which is the team of the record it was brought into, and then Uploaded, with the date and the person. Team first because it is the fact that decides whether you can act on the file at all, and nothing else in that popup answers it. A file whose record is on no team shows no Team row rather than an invented one.

The popup's footer carries Open ›, which goes to the record's own page — for a connector chip, to that connection on the Connections page. A ⊞ collection chip's popup lists the set's current members, computed the moment you open it; the count is never a stored copy.

A record you may not see never opens a popup — a restricted chip stays silent rather than becoming a way to probe it.

The citation block in the details panel

The document's details card — one press away in the document's top bar — carries the whole citation picture as one block:

• Backed by — the incoming proof: every record backing this document, each row wearing the record's own name, a status dot for freshness, and "also backs N others" where a proof is shared. The section appears only when something actually backs the document.
• Cites — the outgoing references, live from the text, grouped by kind with counts; ⊞ collections carry their live member count. Each row wears the same aliveness dot its chip does — green for alive, amber for a source out of reach, red for a target that is gone — so the panel is where you find the two citations that need attention without reading the page.

Rows navigate: clicking one scrolls the text to its chip and opens that chip's popup — the popup stays the one management surface, and the panel stays navigation and status. Names resolve live the way chips do, and a reference whose target no longer exists says so instead of showing a healthy-looking name.

Changing and removing

To point a chip at a different record, delete it and insert the new one with @ or by pasting its link. (Until October 2026 a chip could be re-pointed in place with Rebind or a double-click; both opened the reference picker, which is gone.)

A single click opens the chip's popup (see The chip popup); following the chip to its target is the popup's Open ›, so a click can never yank you off the page you were reading.

To remove a chip, delete it like text. It behaves as a single unit — one backspace takes the whole chip, not the last letter of its label.

Copying a chip into another document carries the reference with it — and only the reference. A pasted chip never grants anything by itself.

Paste that same chip somewhere outside Alchex and what lands is a link, not a reference — see Copying a chip out.

The aliveness dot

Every chip leads with a small dot that says how its target is doing, the moment the page resolves. The dot is always on — including the good news: a green dot is a verified fact, which a bare chip could never state.

A chip has three states, and the difference between the second and the third is the whole point: one is about whether the record exists, the other about whether its source is healthy.

A record that was deleted outright is the one case this table cannot cover, and it is worth knowing why: a deleted record cannot be read, so nothing can tell your reader whether it was destroyed or simply belongs to a team they are not on. Its chip therefore takes the restricted-record form — inactive, with no name and no dot — rather than a red one. Retiring what people cite, and deleting only what nobody did, is what keeps a red named chip the answer they get.

A chip whose target has not answered yet — the first instant of a page, or a kind nothing can verify — shows no dot rather than a hopeful green one. A dot is a measurement, never a guess.

And a surface that cannot check shows no dot either. A chip whose citation points at nothing in your workspace carries its name and no dot, because a dot claims a measurement and none was taken. The places that do check — your documents wherever they open, including the read-only preview beside a conversation — show the real thing: green for a register that is there, red for one that is gone. If you ever see a red dot on a record you know is alive, that is a defect and not a fact about the record; it happened once, on 2026-09-11, when previews were briefly drawing a red dot on every citation they showed, and the answer was never to repair anything in the documents themselves.

The dot is not the only signal, on purpose. The chip's underline changes with it — dashed for a record that is gone, dotted for a source that could not be reached — so the difference survives a colour-blind reader and a black-and-white printout. Those two, and the wording you get on hover, are the whole vocabulary: the chip used to say a single state four ways at once, and four weak marks read as noise rather than as a signal.

A chip with a red dot keeps the record's name. That is deliberate: you cannot choose a replacement for something you can no longer name, and the name is the only thing telling you which of a page's chips is the broken one. Hovering it says so in words — … has been removed — this citation no longer resolves. Replace it with a live record. Clicking it opens the popup, which reads Archived.

An amber dot says the opposite, and says it plainly — the record is still here, but its source could not be reached. Amber is deliberately not red: a connector that is down for an hour used to render exactly like a deletion, and authors spent their time rebinding citations that had never broken.

Which kinds reach which state:

• Document, register, a table in a register and risk chips are green or red, never amber. There is no such thing as an unreachable document: those kinds have no source behind them, so they either exist or they do not.
• Connector chips are green or amber, never red. Amber means the connection is not answering — disconnected, expired or needing a reconnect. A connection that cannot be read stays quiet-green, because "nobody could check" is not "it is broken".
• A rolling set (⊞) is green whenever it resolves. It is a live query rather than a stored list — a set holding nothing resolves to a count of zero, which is an answer, not a failure. A set outside your teams reads as restricted, like any other kind.
• File chips are green or red inside their own document — the existence read is the document's own file list, so the dot is a real measurement: green while the file is there (wearing its current name), red once it is removed. Two honest limits: in chat and previews a file chip stays undotted (no owner in sight, no claim made), and a file chip is non-portable — a file belongs to one document, so the same chip pasted into another document reads gone there rather than borrowing a life it does not have.

Restricted is a fourth thing, and separate

A document, register, risk or connector chip pointing at something outside the teams you belong to renders as a restricted record: no name, no identifier, no kind, no colour. The same document can show a colleague on that team a healthy, named chip and show you this. A record that no longer exists anywhere reads the same way, because telling those two apart would itself say something about a record you are not entitled to know about.

It is a display decision, taken each time the document is opened. Nothing is rewritten: your colleague's copy still reads normally, and if you are later given access the name appears.

Being retired is not the same as being restricted, and it used to be treated as if it were. Archiving a record silently rewrote every past citation of it — in documents and in the assistant's past answers — into "a restricted record", so a reader was told they lacked permission when what had actually happened was that their own team retired the record. An answer written in March changed its words in August. A retired record's citation now keeps its name and goes red, in documents and in chat transcripts alike. The restricted wording is left to the two cases that genuinely cannot be told apart: a record on a team you are not on, and one that has been deleted outright.

If a connection is disconnected or its access expired, chips pointing at it still render, with an amber dot. Reconnect from the connections page.

The assistant reads your chips

A chip is part of the document's text to the AI, not decoration around it. When the assistant reads a document — to answer a question about it, to propose an edit, or to check a requirement against it — every reference arrives as the record it names, with its address, so "backed by [Q3 access review]" is a fact it can follow rather than a gap in the sentence. A check resolves the connected sources the text actually cites; what it finds there is graded like any other evidence.

Where references show up later

Downloading a file — from the details panel's files list, or from Download in a file chip's popup — opens it in a new tab under the name it arrived with. The link is fetched fresh at the moment you click and is short-lived by design, so nothing you leave open on screen keeps a working link to the file.

A chip is a chip everywhere the document is shown, not only where it is written. The same citation renders the same way in the editor, in the read-only preview beside a conversation, and in the panel that opens when you click a record — one document, one rendering. Until September 2026 the read-only views drew a citation the assistant had just written as its raw address, [[sheet:77fa2479-… | Information Security Objectives Register]], where the full page drew the chip: the preview understood every kind of content the editor did except a citation still in the form the assistant hands over, and a paragraph you had just accepted therefore read as machinery beside the conversation that wrote it. Nothing was wrong with the document — opening the full page always showed the chip — and nothing needs repairing in documents written before the fix.

References are part of the document body, so they travel with it: into the copy sent for review, into the published version, into version comparisons, and into exports. A reviewer comparing two versions sees a re-pointed chip as a change like any other. See Versions and history. A reviewer who wants to question one says so in the document's Comments panel, quoting the passage that carries it.

A citation is also part of what search and the assistant read. A chip is not a picture sitting in the text — the thing it names is indexed with the words around it, so a document that cites your access-review register is found by searching for that register, and the assistant answering a question about it can see the citation is there. What is indexed is the reference's name, not its internal id: an identifier nobody would ever type is noise in a search index, and the name is what a person is actually looking for.

The assistant reads the citation in a form it can also write back. When it rewrites a paragraph that cites something, the citation survives the rewrite pointing at the same record — it is not flattened into ordinary words that merely look like a name. This holds for every kind of reference in the table above, and for a chip written in any of the older forms the editor has used over time: they all reach the assistant as the same one address, so none of them is the odd one out that quietly goes missing.

That last point is worth stating plainly, because it has not always been true. Until August 2026 the assistant could only see two of the older chip forms; every other citation reached it as a blank, and a rewrite of that paragraph handed back text with the citation gone — no warning, because from where the assistant sat there had never been one there. If you have a document that lost a chip during an AI edit before then, the chip is not recoverable from the rewrite itself; the version history holds the paragraph as it was, so restore it from there. See Versions and history.

You do not need a saved version to have been made at the right moment for this. The history also lists the editing session the rewrite happened in — the assistant's passes are recorded separately from a person's — so you can return the draft to how it stood immediately before it and take the paragraph back from there.

It also rewrites as little as it can. Asked to change one sentence, it proposes a change to that paragraph alone, so citations in the paragraphs around it are not touched at all — see Which parts it can change. The way it addresses those parts is kept out of the document's words: what search and the assistant read is your text and the names you cited, never the internal identities of the paragraphs holding them.

Citing something does not freeze it. A reference is not a lock: the record you point at can still be retired, by you or by anyone else who may retire it, and nothing refuses on your citation's account. What you get instead is that the citation tells the truth about it — the chip picks up a red dot where the sentence is written and keeps the record's name, so you can see what you lost and replace it with a live record. Restoring the record clears the dot. So the commitment runs one way and it is yours: to notice a red dot and repair it. See Activity and archive for how removal works now.

A reference is a link from your text; a document's scope is the reverse tie — the clauses of your standard the document declares it covers. Scope is edited from the document, and every change to it is logged with who made it. The Compliance page reads what its checks find, not a document's scope.