Security and Observability Settings

Security and observability settings control API exposure, widget data, upload policies, cross-channel session behavior, and the production approval policy that gates deployments.

Public API access

The Public API Access page configures which APIs end-users can access when authenticating through their organization’s identity provider (Azure AD, Okta, Google). Navigation: Project → Settings → Public API Access

Query API

Toggle the Query API to allow authenticated end-users to query agents through the public API endpoint. When you enable it, the following configuration fields appear:

Field	Description
Identity Providers (Auth Profiles)	Select one or more OIDC-compatible auth profiles (OAuth 2.0 App or Azure AD). End-users authenticate through their organization’s IdP.
Allowed Email Domains	Comma-separated list of email domains that can authenticate. Leave empty to allow all domains.
Allowed Origins (CORS)	Optional. A comma-separated list of browser origins that are allowed to make API requests. If this field is not specified, the API does not perform origin validation. If one or more origins are configured, origin validation is enforced for all incoming API requests, and requests from origins not included in the list are rejected.
Allowed Redirect URIs (OAuth Flow)	Comma-separated full URIs where OAuth redirect responses can go. Exact match only — no wildcards.

Session token duration

Field	Description	Default
Session Token TTL (seconds)	How long search session tokens remain valid (60–3600 seconds).	900 (15 min)
Per User (req/min)	Maximum API requests per user per minute.	—
Per Project (req/min)	Maximum API requests per project per minute.	—

The Public Widget Data page controls the tables, columns, and SQL constructs that saved widgets can expose through the analytics:read scope. Projects start with sensitive analytics sources blocked, and all SQL constructs beyond a basic single SELECT stay disallowed until you enable them. Click Save policy to apply your changes. Navigation: Project -> Settings -> Public Widget Data

SQL validation

Choose which saved-widget SQL constructs the platform allows for analytics:read queries. DDL and mutation statements remain blocked regardless of these settings.

Setting	Description
SQL comments	Allows saved SQL widgets to include comments in query text.
Multiple SELECT statements	Allows saved SQL widgets to run more than one SELECT, such as set-operation queries.
JOIN clauses	Allows saved SQL widgets to join allowlisted analytics tables.
UNION, INTERSECT, EXCEPT	Allows saved SQL widgets to combine allowlisted analytics queries with set operations.
CTE clauses	Allows saved SQL widgets to use WITH clauses over allowlisted analytics tables.
OR conditions	Allows saved SQL widgets to use OR inside WHERE clauses. The runtime still applies tenant and project scope outside the expression.

Restricted data

The Restricted data section lets you block specific analytics tables and columns from saved widgets. Every project contains a default configuration that restricts a few sensitive sources. You can remove a default restriction or add your own. After updating the restrictions, save the policy. Block a table

Choose a table from the Select a table menu.
Click Block table.

Blocked tables appear as removable tags. Click the delete icon on a tag to lift the restriction. The default blocked tables are:

abl_platform.audit_events
abl_platform.eval_conversations
abl_platform.eval_scores
abl_platform.hallucination_evaluations
abl_platform.knowledge_gap_evaluations
abl_platform.llm_evaluate
abl_platform.search_queries
abl_platform.spatial_trace_records
abl_platform.custom_pipeline_results
abl_platform.workflow_events

Block a column

Choose a scope from the table menu. Select All tables to block the column everywhere it appears, or select a specific table to block it there only.
Choose a column from the Select a column menu.
Click Block column.

Blocked columns appear as removable tags, grouped by name of the table. The following columns are blocked by default across all tables:

attributes
content
conversation_json
evidence
metadata
output
payload
prompt
query_text
trace_events

Attachments

The Attachment Settings page configures file upload behavior for this project. Navigation: Project → Settings → Attachments General

Setting	Description	Default
Enable Attachments	Allow file uploads in chat sessions.	Enabled (inherited)

Upload Limits

Setting	Description	Default
Maximum File Size	Maximum file size per upload.	20 MB
Allowed File Types	MIME types permitted for upload (maximum 50).	18 types (see below)

Default allowed file types include image/jpeg, image/png, image/gif, image/webp, application/pdf, text/markdown, text/plain, text/csv, application/json, application/msword, application/vnd.openxmlformats-officedocument.wordprocessingml.document, application/vnd.ms-excel, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, audio/mpeg, audio/wav, audio/webm, video/mp4, and video/webm. To add a custom MIME type, enter it in the Add MIME type field and click the add icon. To remove an allowed type, click the × icon next to it. Processing

Setting	Description	Default
PII Policy	How the system handles PII detected in attachments.	Redact
Default Processing Mode	How the system processes newly uploaded files.	Full

Info

Setting	Description	Default
Max Files Per Session	Maximum number of files per session (read-only).	100

Click Save Changes to apply.

Omnichannel

The Omnichannel page configures cross-channel session continuity. Navigation: Project → Settings → Omnichannel Omnichannel settings allow users who start a conversation on one channel to continue it on another without losing context. Conversation Recall

Setting	Description	Default
Enable cross-channel recall	Allow sessions to transfer across channels.	Disabled
Maximum messages to recall	Number of messages the platform carries over to the new channel.	20
Maximum age (days)	How old a conversation can be and still qualify for recall.	30

Allowed channels Lists all supported channels (web, voice, sms, whatsapp, email, slack, teams) with toggles for cross-channel recall participation. Identity Requirements

Setting	Description	Default
Require identity verification	Whether the system requires identity verification for cross-channel recall.	Enabled
Minimum identity tier	The minimum identity verification tier required to recall sessions.	2 - Verified

Consent

Setting	Description	Default
Require explicit consent	Whether the user must explicitly consent before cross-channel recall.	Enabled

Live Transcript Sync Configure real-time transcript synchronization settings for cross-channel sessions. Click Save Settings to apply changes.

If you see a “Failed to save settings” error, verify that your role has write permissions for project settings.

Governance

The Governance page sets the production approval policy for this project. The policy controls how strictly the platform gates production deployments, so a stricter level requires more sign-off before an agent version can ship. Navigation: Project → Settings → Governance Production approval policy The page shows whether the policy is Inherited (default) or set explicitly for the project, along with the Effective level currently in force and its source (for example, Standard from the platform default). To set an explicit policy, drag the Approval strictness slider to a level, then click Save policy.

Level	Sign-off required
Strict	The strictest gate. Applies more sign-off than Standard before a version can ship.
Standard	Requires approval, security, and eval sign-off. The publisher can approve their own version.
Open	The most permissive gate. Applies less sign-off than Standard.

When you select a level, the page shows that level’s sign-off requirements below the slider. Saving an explicit policy overrides the inherited platform default.

​Public API access

​Query API

​Public Widget Data

​SQL validation

​Restricted data

​Attachments

​Omnichannel

​Governance

Public API access

Query API

Public Widget Data

SQL validation

Restricted data

Attachments

Omnichannel

Governance