Uploads are a lifecycle, not a checkbox

Accepting a file begins its lifecycle; it does not approve every later use.

Follow the next consumer

An uploaded filename and declared content type are claims. A browser’s file picker can guide selection, but server checks must enforce the accepted formats and limits. Quarantine is a restricted holding stage separating accepted uploads from files approved for later use.

Each later consumer adds a decision. A preview converter interprets content and consumes resources. Storage determines who can read or alter the result. Download handling determines which authenticated person may receive it. A scanner’s favorable result cannot answer all those questions.

Fictional document record

Assume a community grant portal accepts private PDF applications. Applicants and assigned reviewers may read them; the public may not.

• U1: Document D14 is below the size limit. Server format checks pass, and the scanner reports no detection at the recorded time.
• U2: A converter will produce a preview. Its processing limits and access to other documents are not documented.
• U3: The original remains in restricted storage. The planned preview download has no documented ownership or reviewer check.

Decide what may advance

U1 supports acceptance into quarantine under this policy. “No detection” is a bounded observation, not a promise that every parser will handle the document safely. U2 needs limits on processing time, memory, and permissions. U3 needs authorization for the generated preview as well as the original.

Keep publication or delivery pending until those stages have evidence. If processing fails, retain a controlled failure state rather than silently releasing an incomplete result.

Review outcome: Acceptance documented; processing and retrieval approval pending. Every derived file inherits a need for an explicit access policy.