Examples disclosed herein relate to extracting a plurality of features from a document according to a heuristic extraction model, generating a vector representation of the document according to the plurality of extracted features, associating at least one security rule with the document, determining if a received vector representation matches the stored vector representation of the document, and providing a response to a requested action on the document according to the determination.