DOCUMENT OPS
Scan S3-uploaded contracts for broken digital signature blocks
On every contract PDF uploaded to an S3 bucket, validates the embedded PKCS#7 signature block and certificate chain.
How it runs
The automated pipeline, trigger to output.
- TriggerObject created under S3 contracts/ prefixAWS S3
- ActionFetch PDF and validate PKCS#7 signature blockShell
- LogicBranch on signature valid vs. invalid/missing
- ActionCopy to verified/ or move to quarantine/ in S3AWS S3
- OutputLog signer, time, and verdict to Notion audit DBNotion
What it does
This workflow inspects the cryptographic signature embedded inside each contract PDF, not just the file bytes. When a document is uploaded to S3, it extracts the PKCS#7 signature block, validates the signer certificate chain and the signed byte range, and decides whether the signature actually covers the document as delivered. Documents with a broken, missing, or post-signing-modified signature are quarantined and recorded.
When to use it
Use this when your contracts carry real digital signatures (Adobe/DocuSign certificate-based) and you need to confirm the signature is valid and untampered, rather than only matching a stored hash. Best for regulated workflows that must prove signature integrity for audit.
How it works
- 1An object-created event in the S3 `contracts/` prefix triggers the run.
- 2The PDF is fetched and a shell step runs signature validation, extracting signer, signing time, and a valid/invalid verdict.
- 3A logic branch routes on the verdict.
- 4Valid signatures are copied to the `verified/` prefix; invalid ones are moved to `quarantine/`.
- 5Every result, with signer and reason, is written as a row to a Notion audit database for the compliance log.
Set it up
What you configure once, before turning it on.
- 1Connect AWS S3Buckets, objects, signed URLs.
- 2Connect ShellRun sandboxed commands inside the workspace.
- 3Connect NotionPages, databases, comments.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Document Ops workflows
Narrate new Dropbox PDFs into MP3 audio versions
When a PDF lands in a watched Dropbox folder, extract its text and generate an ElevenLabs voice narration.
On-demand PDF narration via webhook with emailed audio link
Accepts a PDF URL through a webhook, generates an ElevenLabs narration with the requested voice, stores the MP3, and emails the requester a download link.
Triage emailed contract redlines and route by risk
When a counterparty emails a redlined contract, extracts the attachment, diffs clauses against approved templates.
Batch-narrate a Google Drive PDF folder in multiple languages
On a schedule, finds PDFs in a Google Drive folder that lack audio, then generates ElevenLabs narrations in each configured language and files them into per-language subfolders…
Executed Contract Exhibit & Initials Completeness Gate
When a signed contract lands in a Dropbox intake folder, verify every required exhibit, schedule, and initialed page is present.
Draft a negotiation brief from contract clause deviations
An agent reviews a contract against approved templates, researches each deviation.
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.