How we edit the real Word file

The document nobody could open

A consultant needs an engagement letter out by five. She describes it to an AI, gets back a wall of clean prose, pastes it into Word, and spends forty minutes putting it back together. The headings arrive as bold body text. The numbered list restarts at one halfway down. The footnote is an ordinary sentence with a small number typed in front of it. Nothing failed, and that is the frustrating part. What she has is not a document. It is a description of one that somebody now has to build.

That is the shape of almost every AI writing tool. Text in, text out, and the file is somebody else's problem at the end of the chain. Fine for a chat message. Not fine the moment the work leaves your company with your name on it, because a compliance team, a consultancy or an operations lead filing a policy is judged on the file, not on the prose inside it.

For a great many of those teams it never gets that far, because the document cannot be handed over at all. A legal team tightening a settlement draft. A healthcare operator writing the letter a patient reads next week. A bank's compliance desk writing up a case. Their files are full of names, account numbers, dates and diagnoses that are not supposed to travel, and every tool on the market wants all of it up front. That is the trade on offer. Take the leverage and let a client's name into a model you do not control, or keep the confidentiality and do the work by hand at eleven at night.

Two problems, then. The output is not a document, and the input is not allowed to leave. Both are the tool's problem rather than yours. So the document is the product, and the AI works inside it. What the model sees is a version where the sensitive values are already placeholders, mapped back on our side for the reader who is allowed to see them. The placeholders hold through an edit that rewrites the sentence around them. They cover what is easy to forget, including the words inside a hyperlink and the address it points at. An instruction that lands on a placeholder still lands on the real characters, because the restore happens before the change touches the file. One targeted edit went out as a person's placeholder, came back matched, and coloured exactly one line in a fifty page report while leaving eighty seven other mentions of that surname alone.

What matters more than any of that is what it feels like to use, which is nothing at all. No redaction step, no configuration, no safe mode that switches half the ribbon off in exchange for protection. The document on your screen holds the real names the whole time, because the masking protects what leaves the machine rather than obscuring what you are working on. Press Polish, wait, and the finished file comes back, ready to download or to land in Google Drive or OneDrive with its shareable link. The work gets done. The values never leave.

The file is the truth

The first decision is the one everything else hangs off. A .docx is a real format made of real bytes, and we never leave them.

There is no intermediate representation that everything gets converted into and converted back from. When you open a Word file in ZeroSight, we read the actual package. When the AI changes a paragraph, we patch that paragraph inside the package. When you download it, you get those same bytes back with your edit in them. No round trip through Markdown, no rebuild from a simplified model, no export that is close enough.

It matters because of what lives in a real document that a simplified model cannot hold. Hyperlink relationships. Footnote references. Field codes from a citation manager. Numbering definitions that make list levels behave across a whole file. Character styles. Table cell formatting that lives on the paragraph mark rather than on the text. None of that is exotic. It is what sits inside every document a professional actually sends.

We know precisely what it costs to get this wrong, because we got it wrong first. Our earliest rewrite path rebuilt each paragraph from a model of it instead of editing the paragraph in place, and it flattened every formatting run after the first. Bold survived at the start of a sentence and disappeared in the middle. Links became plain words that still looked blue. It passed every test we had, because our tests were about text and the damage was about everything around the text.

Then we opened a real fifty page report written by someone else. Within an hour it had produced two more findings. Word writes a no-numbering marker as a numbering id of zero, which our parser read as a bullet at level twelve, so paragraphs that were not lists indented themselves into the margin. And our canvas paginated only on hard page breaks, of which that report had three, so fifty pages rendered as one continuous sheet ninety three pages long. Neither bug was reachable until a document we had not generated ourselves walked in the door.

The rule that came out of it has held ever since. A document format is not something you approximate. Either you carry the file or you damage it, and there is no third option a client will fail to notice.

Always saved, always openable

The second decision is that the document is never in a state you would be afraid of.

Every change writes a revision. Typing autosaves on a short timer. An AI run writes checkpoints as it goes rather than one commit at the end. Revisions are immutable and they are kept, so there is no moment where a crash, a closed tab or a cancelled generation leaves you holding half a file. Stop a twenty page generation after four pages and you have a four page document you can read, download and keep working on.

That behaviour was earned by a bug. In an early build a generation held everything in memory until it finished, so pressing stop threw away thousands of words the model had already written, and billed for them anyway. The fix was to find a point in the stream that is always safe to cut at, commit everything before it, and buffer the rest. Stopping became an early ending instead of a loss.

The harder half is that two writers are working at once and one of them is a machine. You fix the title while the AI recolours a paragraph on page nine. Both want to save.

The obvious answer is to lock the whole document, and we shipped that first. It failed in the most irritating way available. Any keystroke anywhere invalidated the AI's edit everywhere, so the model would re-read, re-target, re-send, and lose the race again to the next keystroke. Correct, and useless.

What happens now is that we compare what actually changed. If the AI's edit is formatting only, and the ordering of the blocks it was working from still holds, its change is rebased onto your newer version and both land. If the edit rewrites content, or the document has moved underneath it in a way that makes its targets unreliable, it refuses and reads again rather than guessing. Position based edits are safe only while the positions are still true, and the system knows which case it is in. On a live document we watched the AI commit successfully through five revisions of somebody typing.

Reading a hundred pages without drowning

Generating a document is the easy half. Working on one that already exists is where most tools quietly fall over.

Ask an AI to summarise a hundred and twenty page report and something has to give. Either the whole document goes into the model's context at once, which is slow, expensive and eventually impossible, or the model reads the first chunk and answers confidently about the rest. The second failure is the dangerous one, because it looks exactly like success.

Our read path is paginated, with a continuation loop driving it. The model first receives a complete map of the document, every block with its identity, kind and position, and no body text at all. That map is small, and it is enough to target an edit precisely without loading a word of prose. A formatting request across a whole document now reads no content whatsoever, which took the cost of a targeted change down by more than an order of magnitude.

When content is genuinely needed it arrives in ranges. After each range the model writes a short digest of what it just read, and that digest travels forward while the raw text falls away, so the running understanding grows while the memory cost stays flat. A coverage check refuses to let the turn finish while any part of the document is still unread. Asked to summarise that fifty page report, it ran seven continuations, reached the final block, and named the appendix and the bibliography correctly at the end.

We found the honesty gap here the hard way as well. An early version read a third of a document, stopped, and wrote a summary of the whole thing from the previews in the map. Every sentence was plausible. That is now structurally impossible, because the next unread range is forced rather than suggested.

Writing that reads like a person wrote it

Then there is the part nobody expected to become a product requirement.

AI generated text is increasingly marked. Providers have begun embedding invisible statistical signals in what their models write, driven by transparency rules that came into force this year, and a growing market of style classifiers claims to identify machine writing with no signal at all. Both land on the same person, and it is not the person you might assume. It is the consultant whose deliverable gets run through a detector by a procurement team. The analyst whose report is checked by a client. The firm whose written work is the product it sells.

Their problem is not that they used AI. Their problem is that a document carrying their name can be flagged by a tool nobody can appeal to, on evidence nobody can inspect.

So Polish is a first class button in the ribbon, beside Summary and Format. Press it and the document is rewritten page by page into natural human prose. It runs on the ZeroSight Writing Model, which sits outside every provider's content marking programme, inside the same protection boundary as everything else.

What it is not is a detector beater, and we will not sell it as one. What we can offer is measurement. On a memo drafted by a frontier model and then polished once, a public rhythm classifier read the result as fully human. On the fifty page report, a complete pass took 24 minutes, changed 348 of 936 blocks, cut 15% of the words, and preserved every link, footnote, field and table byte for byte. A commercial detector's deep scan on the polished file came back highly confident entirely human, at 96%.

The prose is measurably better, which is the honest claim and the useful one. Hedges come out. Sentences stop ending the same way six times in a row. Facts stay exactly where they were. The document reads like the person who signed it wrote it.

What this adds up to

None of these four decisions is glamorous on its own. Keep the real bytes. Save constantly and keep every version. Read long documents in ranges with a running digest. Rewrite prose so it reads like a person.

Together they change what the tool is for. You are not generating text you will have to rebuild into a document. You are working inside the document, with an agent that can read all hundred pages of it, edit the paragraph you meant, and hand back a file that opens in Word exactly as you left it, with the links live and the footnotes numbered and the tables intact.

And because this is ZeroSight, the protection layer runs underneath all four of them, on every request, without being asked. The document on your screen always holds the real values. The model never does.

That is the whole idea. The file is the product, so treat it like one.