> ## Documentation Index > Fetch the complete documentation index at: https://koreai-content-gov.mintlify.site/llms.txt > Use this file to discover all available pages before exploring further. # Security and Observability Settings Security and observability settings control API exposure, widget data, upload policies, cross-channel session behavior, and the production approval policy that gates deployments. ## Public API access The **Public API Access** page configures which APIs end-users can access when authenticating through their organization's identity provider (Azure AD, Okta, Google). **Navigation**: **Project** → **Settings** → **Public API Access** ### Query API Toggle the **Query API** to allow authenticated end-users to query agents through the public API endpoint. When you enable it, the following configuration fields appear: | Field | Description | | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Identity Providers (Auth Profiles)** | Select one or more OIDC-compatible auth profiles (**OAuth 2.0 App** or **Azure AD**). End-users authenticate through their organization's IdP. | | **Allowed Email Domains** | Comma-separated list of email domains that can authenticate. Leave empty to allow all domains. | | **Allowed Origins (CORS)** | Optional. A comma-separated list of browser origins that are allowed to make API requests. If this field is not specified, the API does not perform origin validation. If one or more origins are configured, origin validation is enforced for all incoming API requests, and requests from origins not included in the list are rejected. | | **Allowed Redirect URIs (OAuth Flow)** | Comma-separated full URIs where OAuth redirect responses can go. Exact match only — no wildcards. | **Session token duration** | Field | Description | Default | | ------------------------------- | -------------------------------------------------------------- | ------------ | | **Session Token TTL (seconds)** | How long search session tokens remain valid (60–3600 seconds). | 900 (15 min) | | **Per User (req/min)** | Maximum API requests per user per minute. | — | | **Per Project (req/min)** | Maximum API requests per project per minute. | — | *** ## Public Widget Data The **Public Widget Data** page controls the tables, columns, and SQL constructs that saved widgets can expose through the `analytics:read` scope. Projects start with sensitive analytics sources blocked, and all SQL constructs beyond a basic single SELECT stay disallowed until you enable them. Click **Save policy** to apply your changes. **Navigation**: **Project** -> **Settings** -> **Public Widget Data** ### SQL validation Choose which saved-widget SQL constructs the platform allows for `analytics:read` queries. DDL and mutation statements remain blocked regardless of these settings. | Setting | Description | | ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------- | | **SQL comments** | Allows saved SQL widgets to include comments in query text. | | **Multiple SELECT statements** | Allows saved SQL widgets to run more than one SELECT, such as set-operation queries. | | **JOIN clauses** | Allows saved SQL widgets to join allowlisted analytics tables. | | **UNION, INTERSECT, EXCEPT** | Allows saved SQL widgets to combine allowlisted analytics queries with set operations. | | **CTE clauses** | Allows saved SQL widgets to use WITH clauses over allowlisted analytics tables. | | **OR conditions** | Allows saved SQL widgets to use OR inside WHERE clauses. The runtime still applies tenant and project scope outside the expression. | ### Restricted data The **Restricted data** section lets you block specific analytics tables and columns from saved widgets. Every project contains a default configuration that restricts a few sensitive sources. You can remove a default restriction or add your own. After updating the restrictions, save the policy. **Block a table** 1. Choose a table from the **Select a table** menu. 2. Click **Block table**. Blocked tables appear as removable tags. Click the delete icon on a tag to lift the restriction. The default blocked tables are: * `abl_platform.audit_events` * `abl_platform.eval_conversations` * `abl_platform.eval_scores` * `abl_platform.hallucination_evaluations` * `abl_platform.knowledge_gap_evaluations` * `abl_platform.llm_evaluate` * `abl_platform.search_queries` * `abl_platform.spatial_trace_records` * `abl_platform.custom_pipeline_results` * `abl_platform.workflow_events` **Block a column** 1. Choose a scope from the table menu. Select **All tables** to block the column everywhere it appears, or select a specific table to block it there only. 2. Choose a column from the **Select a column** menu. 3. Click **Block column**. Blocked columns appear as removable tags, grouped by name of the table. The following columns are blocked by default across all tables: * `attributes` * `content` * `conversation_json` * `evidence` * `metadata` * `output` * `payload` * `prompt` * `query_text` * `trace_events` *** ## Attachments The **Attachment Settings** page configures file upload behavior for this project. **Navigation**: **Project** → **Settings** → **Attachments** **General** | Setting | Description | Default | | ---------------------- | ------------------------------------ | ------------------- | | **Enable Attachments** | Allow file uploads in chat sessions. | Enabled (inherited) | **Upload Limits** | Setting | Description | Default | | ---------------------- | --------------------------------------------- | -------------------- | | **Maximum File Size** | Maximum file size per upload. | 20 MB | | **Allowed File Types** | MIME types permitted for upload (maximum 50). | 18 types (see below) | Default allowed file types include `image/jpeg`, `image/png`, `image/gif`, `image/webp`, `application/pdf`, `text/markdown`, `text/plain`, `text/csv`, `application/json`, `application/msword`, `application/vnd.openxmlformats-officedocument.wordprocessingml.document`, `application/vnd.ms-excel`, `application/vnd.openxmlformats-officedocument.spreadsheetml.sheet`, `audio/mpeg`, `audio/wav`, `audio/webm`, `video/mp4`, and `video/webm`. To add a custom MIME type, enter it in the **Add MIME type** field and click the **add** icon. To remove an allowed type, click the **×** icon next to it. **Processing** | Setting | Description | Default | | --------------------------- | --------------------------------------------------- | ------- | | **PII Policy** | How the system handles PII detected in attachments. | Redact | | **Default Processing Mode** | How the system processes newly uploaded files. | Full | **Info** | Setting | Description | Default | | ------------------------- | ------------------------------------------------ | ------- | | **Max Files Per Session** | Maximum number of files per session (read-only). | 100 | Click **Save Changes** to apply. *** ## Omnichannel The **Omnichannel** page configures cross-channel session continuity. **Navigation**: **Project** → **Settings** → **Omnichannel** Omnichannel settings allow users who start a conversation on one channel to continue it on another without losing context. **Conversation Recall** | Setting | Description | Default | | ------------------------------- | ---------------------------------------------------------------- | -------- | | **Enable cross-channel recall** | Allow sessions to transfer across channels. | Disabled | | **Maximum messages to recall** | Number of messages the platform carries over to the new channel. | 20 | | **Maximum age (days)** | How old a conversation can be and still qualify for recall. | 30 | **Allowed channels** Lists all supported channels (**web**, **voice**, **sms**, **whatsapp**, **email**, **slack**, **teams**) with toggles for cross-channel recall participation. **Identity Requirements** | Setting | Description | Default | | --------------------------------- | --------------------------------------------------------------------------- | ------------ | | **Require identity verification** | Whether the system requires identity verification for cross-channel recall. | Enabled | | **Minimum identity tier** | The minimum identity verification tier required to recall sessions. | 2 - Verified | **Consent** | Setting | Description | Default | | ---------------------------- | --------------------------------------------------------------------- | ------- | | **Require explicit consent** | Whether the user must explicitly consent before cross-channel recall. | Enabled | **Live Transcript Sync** Configure real-time transcript synchronization settings for cross-channel sessions. Click **Save Settings** to apply changes. If you see a "Failed to save settings" error, verify that your role has write permissions for project settings. *** ## Governance The **Governance** page sets the production approval policy for this project. The policy controls how strictly the platform gates production deployments, so a stricter level requires more sign-off before an agent version can ship. **Navigation**: **Project** → **Settings** → **Governance** **Production approval policy** The page shows whether the policy is **Inherited (default)** or set explicitly for the project, along with the **Effective** level currently in force and its source (for example, Standard from the platform default). To set an explicit policy, drag the **Approval strictness** slider to a level, then click **Save policy**. | Level | Sign-off required | | ------------ | -------------------------------------------------------------------------------------------- | | **Strict** | The strictest gate. Applies more sign-off than Standard before a version can ship. | | **Standard** | Requires approval, security, and eval sign-off. The publisher can approve their own version. | | **Open** | The most permissive gate. Applies less sign-off than Standard. | When you select a level, the page shows that level's sign-off requirements below the slider. Saving an explicit policy overrides the inherited platform default.