Use Cases

Which of these is you?

Every layer you own decides on who, where, what runs, and who sent it. Here are six places where the file crossing the line is nobody’s job, written the way the problem shows up, not the way a product is deployed. Each one names the layer you already have, the question it never asks, and what a content verdict changes.

01 · Coding agents

“My developers run coding agents against our repos.”

An agent with a file tool reads whatever the repository contains: the vendored dependency nobody opened, the fixture somebody downloaded, the README in a package pulled in yesterday. It also writes files, fetches pages, and runs commands. Every one of those is content the agent did not author, arriving inside the model with the authority of a tool result.

The layer you havePermissions and allowlistsThey decide which paths the agent may touch and which tools it may call. A read that is allowed is allowed whatever the file says.

The question it never asksWhat is in the file it was allowed to read?And what is in the file it is about to write, or in the output of the command it just ran, before the model reads any of it.

What Subtext returnsThe same tools, inspectedSame tool names the agent already calls. Every read and every fetch is scored before it returns, every write before it lands. A refused read comes back as a tool error that names the file, so the agent fails the step instead of acting on the payload. The record of what it asked for is written by a component the agent cannot reach.

Deploys on Agents, via MCP Proof Same file, two paths·The agent reads it first

02 · AI over your documents

“We are pointing AI at our documents and file shares.”

A copilot over a share, a retrieval index over a document store, an assistant that summarizes whatever it is handed. The file was fine when a person opened it, because a person reads the page. A model reads the text layer, the metadata, the image, and the text positioned where no page shows it. Two readings of one file, and the model acts on the one you never saw.

The layer you haveAccess control and labelsWho may open the store, and what a document was classified as when someone looked at it. Both are about the person and the wrapper.

The question it never asksWhat will the model extract from this?As opposed to what a person sees. The two diverge on exactly the files that matter, and nothing in the access path reads either one.

What Subtext returnsThe file as a model would read itReduced to text across every modality, then judged. Inspected at the moment of retrieval, when the AI asks for the file, not by indexing your estate. No map, no catalog, no second copy of your data.

Deploys on Applications, via REST API·Agents, via MCP Proof One file, two readings·Approved use is the risk

03 · Data leaving

“Data is leaving in files our tools cannot read.”

Pattern matching finds the standard form: digits with dashes, a key with a known prefix. It does not find the number spelled out in words, written in another language, read aloud in a voice memo, painted into a spectrogram, or carried as a QR code on a slide. A person would have to work to use any of those. A model does not.

The layer you haveData loss prevention at egressMatches patterns in the text it can parse. When it cannot parse the file, the log says unsupported and the gate says allow.

The question it never asksCould I read this at all?A zero from a file the tool could not open looks exactly like a zero from a file it read and found clean. The file your scanner skipped is the one your AI reads anyway.

What Subtext returnsA verdict, or a declared declineThe content judged as a model would read it, across text, image, audio and video. When it cannot read a file it says so in the verdict instead of passing it, and whether that holds for review or blocks is your setting, applied the same way every time.

Deploys on Network traffic, via ICAP·Applications, via REST API Proof You can’t opt out of a file anymore·Audio and video

04 · Files arriving

“Files come in from people we do not control.”

Uploads from customers, transfers from partners, archives from vendors, a web page a user was told to open. Antivirus asks whether the file is known bad. Sanitization rebuilds the container and keeps whatever the format allows. An instruction aimed at the reader, a password in the filename, a command to paste: all of those are allowed by the format, and none of them is on a list.

The layer you haveReputation, signatures, sanitizationKnown-bad matching at the gateway, and a rebuild that strips what can run. Both leave what the file says intact, because what it says is not what they check.

The question it never asksWhat does the content say, and to whom?A file that tells its reader to do something is clean by every container test. The reader is now a person, or a model, that will do it.

What Subtext returnsA verdict on what it carriesIncluding what it tells a reader to do, what it hides past where the format says it ends, and what is nested inside. The file is never modified, so the evidence of what was there is preserved with the verdict.

Deploys on Network traffic, via ICAP·Applications, via REST API Proof ClickFix hands the user the payload·Decryption baiting

05 · No route out

“We cannot send anything out to get a verdict.”

Classified networks, operational technology, ships, sites with no route to the internet. Every inspection product that phones home is disqualified before the evaluation starts, which leaves those networks with the thinnest content coverage anywhere, exactly where the people running them are most careful.

The layer you haveSignatures carried in by handA feed that updates when someone walks it across, and a person who opens the file to see what it is. Careful, slow, and blind to anything that is not already known.

The question it never asksWhat is inside this, decided here?With nothing outside the room in the decision. If the answer requires uploading the file, the answer already moved the file off your network.

What Subtext returnsThe same verdict, with the door shutOne container with every model it needs baked in. No calls out, no feed, nothing external in the decision path. The same file gives the same answer on a network that has never seen the internet.

Deploys on Every boundary Proof If it has to phone home to decide·The benchmark

06 · The verdict you have to defend

“When a file is blocked, I have to explain why.”

A blocked file stops a transfer, a release, or a person’s afternoon, and someone asks what happened. The answer has to survive the help desk, the business owner, and eventually an auditor. A probability from a model that might answer differently tomorrow is not an answer. Neither is a reputation score nobody can reconstruct.

The layer you haveClassifiers and reputation scoresA confidence number, a category label, a verdict from a feed that has since updated. Accurate on the day, and impossible to repeat on the day someone asks.

The question it never asksCould I give this answer again, with a reason?Same file, same verdict, every time, and a reason a person can read back. A control that cannot explain itself is a control you cannot defend.

What Subtext returnsA verdict with its reason chainBlock, review, or pass, with the per-signal reason that produced it. The record names the user, the device, the agent client and version, the tool that asked, and the URL the content came from, bound to the bytes by hash in a tamper-evident chain. No drift, no per-user state. Hand the file to a second instance a year later and it says the same thing.

Deploys on Every boundary Proof A control you cannot explain·What the content was, not just that a tool ran

Bring the file that worries you.

A thirty-minute demo scores a file live, yours or ours, and we talk through which of these boundaries it crosses in your environment. Monitor mode first, so you see what your traffic carries before anything is enforced.

Runs on your side of the wire. No cloud account, no feed to keep current.

Book a demo → Where it sits