Can Rise dynamically reference an externally hosted file?

The technical answers above cover the how — iframe or embed with a stable URL, watch for cross-origin issues. The question I'd add from compliance work is version integrity. If a client swaps the PDF at the same URL, every learner who already completed attested to a different document, and your completion records no longer prove which version anyone saw. I'd use versioned filenames (policy_v3.pdf, not policy.pdf) instead of overwriting, and treat a document swap as a course update: republish and decide up front whether existing completions stay valid. Also plan for caching — same-URL swaps are the classic "I updated it, why are they seeing the old one" support ticket.