Security and observability settings control PII detection, API exposure, file upload policies, and cross-channel session behavior.
PII Protection
The PII Protection page configures PII detection patterns, redaction strategies, and consumer access controls for this project.
Navigation: Project → Settings → PII Protection
Global Settings
| Setting | Description | Default |
|---|
| PII Detection | Scan agent inputs for PII using active patterns. | Enabled |
| PII Output Redaction | Apply redaction to agent outputs before delivery to consumers. | Disabled |
Credential, secret, and high-risk token scrubbing stays active for logs, traces, session history, and normal API responses even when you disable configurable PII detection.
Built-in Patterns
Built-in patterns use pre-configured, optimized detection logic. You can adjust redaction, per-consumer access, and enabled state for each pattern. Only disable high-risk patterns if you have a documented reason and understand the compliance impact.
| Pattern | Tag | Description |
|---|
| Email Address | Email | Detects email addresses in text. |
| Phone Number | Phone | Detects phone numbers (US and international formats). |
| Social Security Number | SSN | Detects US Social Security Numbers (XXX-XX-XXXX). |
| Credit Card Number | Credit Card | Detects credit/debit card numbers (Visa, MC, Amex, etc.). |
| IP Address | IP Address | Detects IPv4 and IPv6 addresses. |
Custom Patterns
Click Add Pattern to define organization-specific PII detection rules. The Create PII Pattern dialog includes the following sections:
Basics
| Field | Description |
|---|
| Name | A unique name for the pattern (for example, US Social Security Number). Required. |
| Description | Optional description of what the pattern detects. |
| Enabled | Toggle to activate or deactivate the pattern. |
| Field | Description |
|---|
| Regex Pattern | The regular expression that matches sensitive data. Required. |
| PII Type | Classification of the PII type (Custom or a predefined category). |
| Validator Expression | Optional secondary regex to post-filter matches. The system keeps only matches that pass this regex. |
| Option | Description |
|---|
| Predefined Label | Replace matched text with a configurable label (default: [REDACTED_<TYPE>]). |
| Masked | Replace matched text with placeholder characters. |
| Random | Replace matched text with random characters. |
| Field | Description |
|---|
| Default Render Mode | How PII appears by default: Redacted, Tokenized, or Original. |
| Per-Consumer Overrides | Click Add Consumer to set render mode overrides for specific consumers. |
LLM consumers can’t receive original plaintext. The system stores a saved LLM override of Original as Tokenized, and an Original default adds an explicit LLM Tokenized override.
Public API Access
The Public API Access page configures which APIs end-users can access when authenticating through their organization’s identity provider (Azure AD, Okta, Google).
Navigation: Project → Settings → Public API Access
Query API
Toggle the Query API to allow authenticated end-users to query agents through the public API endpoint. When you enable it, the following configuration fields appear:
| Field | Description |
|---|
| Identity Providers (Auth Profiles) | Select one or more OIDC-compatible auth profiles (OAuth 2.0 App or Azure AD). End-users authenticate through their organization’s IdP. |
| Allowed Email Domains | Comma-separated list of email domains that can authenticate. Leave empty to allow all domains. |
| Allowed Origins (CORS) | Comma-separated list of browser origins allowed to make API calls. |
| Allowed Redirect URIs (OAuth Flow) | Comma-separated full URIs where OAuth redirect responses can go. Exact match only — no wildcards. |
| Field | Description | Default |
|---|
| Session Token TTL (seconds) | How long search session tokens remain valid (60–3600 seconds). | 900 (15 min) |
| Per User (req/min) | Maximum API requests per user per minute. | — |
| Per Project (req/min) | Maximum API requests per project per minute. | — |
Attachments
The Attachment Settings page configures file upload behavior for this project.
Navigation: Project → Settings → Attachments
General
| Setting | Description | Default |
|---|
| Enable Attachments | Allow file uploads in chat sessions. | Enabled (inherited) |
| Setting | Description | Default |
|---|
| Maximum File Size | Maximum file size per upload. | 20 MB |
| Allowed File Types | MIME types permitted for upload (maximum 50). | 18 types (see below) |
image/jpeg, image/png, image/gif, image/webp, application/pdf, text/markdown, text/plain, text/csv, application/json, application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document, application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, audio/mpeg, audio/wav, audio/webm, video/mp4, and video/webm.
To add a custom MIME type, enter it in the Add MIME type field and click the add button. To remove an allowed type, click the × next to it.
Processing
| Setting | Description | Default |
|---|
| PII Policy | How the system handles PII detected in attachments. | Redact |
| Default Processing Mode | How the system processes newly uploaded files. | Full |
| Setting | Description | Default |
|---|
| Max Files Per Session | Maximum number of files per session (read-only). | 100 |
Omnichannel
The Omnichannel page configures cross-channel session continuity.
Navigation: Project → Settings → Omnichannel
Omnichannel settings allow users who start a conversation on one channel to continue it on another without losing context.
Conversation Recall
| Setting | Description | Default |
|---|
| Enable cross-channel recall | Allow sessions to transfer across channels. | Disabled |
| Maximum messages to recall | Number of messages the platform carries over to the new channel. | 20 |
| Maximum age (days) | How old a conversation can be and still qualify for recall. | 30 |
| Setting | Description | Default |
|---|
| Require identity verification | Whether the system requires identity verification for cross-channel recall. | Enabled |
| Minimum identity tier | The minimum identity verification tier required to recall sessions. | 2 - Verified |
| Setting | Description | Default |
|---|
| Require explicit consent | Whether the user must explicitly consent before cross-channel recall. | Enabled |
If you see a “Failed to save settings” error, verify that your role has write permissions for project settings.
