docs(permission-groups): record the data-drain policy and make the cost hint honest

Data drains are an organization-admin instrument, deliberately above member
permission groups like the audit-log surface — the reader of a drained
record is the organization, not a member. Recorded on the drain access gate
so the next auditor finds a decision, not a gap. The hideCostInfo hint no
longer promises that ALL exports omit spend.

Author: waleedlatif1

apps/sim/lib/data-drains/access.ts

@@ -24,7 +24,13 @@ export type DrainAccessResult =
 /**
  * Auth + membership + role + enterprise-plan gate shared by every data-drain
  * route. Owner/admin role is required for reads as well as writes since drain
- * configs expose customer bucket names and webhook URLs. On Sim Cloud the
+ * configs expose customer bucket names and webhook URLs.
+ *
+ * Deliberately above member permission groups, like the audit-log surface:
+ * the reader of a drained record is the organization, not a member, so the
+ * per-member log projections (`hideCostInfo`, `hideTraceSpans`) do not apply
+ * to what a drain serializes, and no group capability gates configuring one —
+ * the owner/admin requirement is the whole access story. On Sim Cloud the
  * gate is the Enterprise plan; on self-hosted it's `DATA_DRAINS_ENABLED`,
  * which 404s when unset so a newer image doesn't silently expose drains.
  */

apps/sim/lib/permission-groups/fields.ts

@@ -397,7 +397,7 @@ export const PERMISSION_GROUP_FIELDS = {
     id: 'hide-cost-info',
     label: 'Execution Cost',
     category: 'Logs',
-    hint: 'Withhold execution cost. Logs and exports omit cost and token spend.',
+    hint: 'Withhold execution cost. Logs and member exports omit cost and token spend; organization-level data drains, configurable by org admins only, are not projected.',
   }),
   disableKnowledgeBaseCreation: booleanRestriction('capability', {
     scope: 'workspace',