docs(features): document the egress filter's secret, PII and PHI controls

[piyushbhavsarr]

Summary

The Egress Filter page existed but carried no screenshots and covered only part of the surface — the PII/PHI detector, the per-message evidence trail, the permission model and the raw-value reveal flag were all undocumented. This expands it to the whole feature and illustrates it from the product.

features/ai/egress-filter.md — rewritten:

• Scope of "outbound" — prior conversation turns, retrieved KB documents, tool and command output, agent scratchpad and the system prompt, not just what a user typed. This is the fact that makes the feature make sense.
• The built-in secret rule corpus — cloud credentials, provider API keys, SCM/package tokens, JWTs and Bearer headers, PEM blocks and kubeconfig material, DB URLs with passwords, SSNs and Luhn-valid cards — plus high-entropy-blob and a warning that it will dominate detect-mode events.
• PII / PHI scrubbing end to end — reversible tokenisation and response rehydration, per-category detection (regex for EMAIL/PHONE, NER for PERSON/LOCATION), what is never scrubbed (IPs, deliberately — they are investigation signal) and what is never restored (credentials, redacted irreversibly even when tokenisation is on).
• The per-message evidence trail — the chips on an answer, the detail view behind them, and the egress-… / scrub-… audit IDs for log correlation.
• EGRESSFILTER_REVEAL_VALUES — documented with a :::danger note explaining that it writes matched secrets and personal data unmasked into a persistent table, and that a tenant running PII Enforce for HIPAA/GDPR is not compliant with it on.
• Permissions — egressfilter:Read / egressfilter:Write, tenant-scoped with no per-account dimension.

features/ai/ai-gateway.md — the Egress secret filter (DLP) control on Data & privacy was undocumented; it applies the same detector to gateway-proxied traffic. Also notes the retention/visibility limits on captured bodies.

features/ai/index.md, features/security.md — one-line pointers so the feature is reachable from both entry pages. Security is the page a compliance reviewer reads, and it said nothing about what leaves for a model provider.

Type of change

• Update to existing documentation

Checklist

• I ran npm run build locally and the site builds without errors
• I ran npm run lint locally and lint passes
• Internal links work; new external links open the correct page
• My commits are signed off (DCO — git commit -s)
• I read CONTRIBUTING.md

onBrokenLinks is throw, so a clean build confirms every internal link resolves.

Screenshots (if visual changes)

Seven new screenshots under features/ai/img/, taken from the dev instance: the two halves of the Egress Filter tab, the custom-pattern dialog, the chips on a NuBi answer, both halves of the detail modal, and the gateway Data & privacy tab.

Additional notes

Two screenshots are edited, both to keep dev-tenant identifiers out of public docs. Nothing else in any image is altered.

Image	Edit
egress-filter-details-secrets.png	The dev tenant has EGRESSFILTER_REVEAL_VALUES enabled, so the detail modal renders matched values verbatim — including a GCP-shaped key that arrived through the agent scratchpad rather than the test prompt. Masked with an opaque bar; the pixels are overwritten, not blurred.
gateway-data-privacy.png	The "Last changed by" line carried a real internal user UUID. Reshot with an all-zero example UUID substituted in the DOM, so the line keeps its real font and shape.

Everything else visible in the screenshots is synthetic: the AWS key is invented, and the phone numbers are in the reserved 555-01XX fictional range.

Two consequences worth a reviewer's attention:

1. The detail-view screenshots show the testing-mode rendering rather than the default shape-and-length one, which is why they carry the raw values shown — testing mode badge. The page calls this out directly under the :::danger note. If we would rather ship the default view, someone needs to turn the flag off on the dev tenant and the two images can be reshot.
2. Separately from this PR: if that GCP key is real, it is sitting unmasked in llm_conversation_messages.metadata on dev and rendering for anyone who opens that conversation.

Deliberately left out: the platform-level LLM_SERVER_EGRESSFILTER_* environment variables. No other page in the docs carries LLM_SERVER_* configuration, so the page says "platform level" and stops there. Worth adding as a self-hosted operator section if that gap comes up.

🤖 Generated with Claude Code

https://claude.ai/code/session_018kNH7US6EMJeysNtg6dKza

[gemini-code-assist]

Code Review

This pull request significantly expands and updates the documentation for the AI Gateway, Egress Filter, and security features, adding detailed explanations of data privacy, egress secret filtering, PII/PHI scrubbing, and audit capabilities. The review feedback focuses on improving terminology consistency across the documentation, specifically suggesting capitalizing 'stable ID', correcting 'Egressfilter' to 'Egress Filter', and aligning the policy modes to 'detect, enforce, or redact'.