Add reusable content screening with document quarantine and review

[paullizer]

Summary

Add a reusable content-screening framework with deterministic PII/pattern/value checks and optional model-based analysis. Its first integrations are knowledge extraction and on-demand scans of existing personal, group, and public workspace documents. Any detected finding holds the entire document out of normal use until an authorized person completes its review.

Priority: P1
Size: XL
Assignee: Paul Lizer (@paullizer)

User Value

A reported customer scenario involved white text in a public document that was not apparent to a human reader but appeared in extracted content. That text attempted to influence how an AI valued the document relative to other sources. Sensitive data and document-borne instructions should be detected before extracted knowledge becomes usable, with a practical way to inspect findings and approve or remediate the document.

The framework should also provide a common foundation for later user-message, AI-response, agent-workflow, and outbound-capability screening rather than creating a document-only rule engine.

Proposed Behavior

• First-release scope: new and reprocessed workspace knowledge, including file sync, programmatic uploads, generated-file promotion into a workspace, and chat files handed off to a workspace. Administrators can scan selected documents, selected workspaces, or all workspaces. Chat-only attachments and ordinary messages are not first-release integrations.
• Deterministic evaluation: selectable starter rules for common structured PII and sensitive patterns, custom regex, and exact values/phrases. Rules have stable IDs, descriptions, severity, versioning, and bounded execution. Provide rule testing without publishing content.
• Model evaluation: select an approved configured inference model through the existing model-connection infrastructure. Provide versioned default instructions for prompt injection, source-priority manipulation, sensitive information, and secrets, plus editable/custom criteria. Support page, chunk, and bounded multi-page/multi-chunk windows with complete coverage rather than sampling or silent truncation.
• Policy inheritance: administrators define mandatory baseline rules. Workspace owners/managers can add scoped rules and instructions but cannot weaken or bypass the required baseline. Optional model checks become required checks when enabled in the effective policy.
• Opt-in and storage: ship disabled. Enabling screening requires Enhanced Citations and a working connection to its existing Azure Blob Storage account. Reuse that account for private staged content, retained originals, and clean derivatives.
• Extraction before publication: stage extracted content durably before normal embeddings, metadata enrichment, indexing, and use. Scan all extracted text, including text not apparent in the visual document. No early page/chunk may become usable while later content is still awaiting evaluation.
• Existing documents: keep queued documents available until their individual scan starts. At scan start, hold that document; findings, incomplete scans, and evaluation errors keep it held. Cancellation, retries, configuration changes, or disabling future scans must not silently release an existing hold.
• Enforcement: quarantine is server-side and applies to RAG/search, cached results, explicit document analysis/comparison, citations/previews/downloads, native tabular access, assigned knowledge, and agent/tool retrieval. Ordinary document lists may show safe status metadata, not restricted evidence. Previously sent or downloaded information cannot be retroactively recalled.
• Review authority: personal workspace owners and group/public workspace Owners, Admins, and DocumentManagers may review and approve within their authorized scope, including their own uploads. Administrative permission to launch cross-workspace scans must not become an unrestricted private-content browsing permission.
• Review actions: inspect findings, approve while retaining a visible flag and recorded reason, remove source pages where page mapping exists, remove exact extracted lines/spans or structured data, reject/keep held, or delete the document. Validate decisions against the exact content revision and policy/scan record.
• Safe remediation: publish only sanitized knowledge and clean text/structured-data derivatives. Keep the original restricted to reviewers after remediation. Rebuild affected chunks, embeddings, metadata, tabular derivatives, citation mappings, and caches from sanitized content; rescan and obtain explicit approval before release. Layout-preserving PDF/Office redaction is not required in this release.
• Durable operations: persisted jobs, per-document checkpoints, leases, bounded retries, cancellation/resumption, progress, and idempotent findings/approval creation. Failed publication remains held. Persist a bounded, append-only application audit trail and send minimal in-app notifications without sensitive excerpts.
• UI parity: configuration, scan controls, quarantine indicators, and review/remediation are available in both classic and React V2 interfaces.

Acceptance Criteria

• Screening is off by default and cannot be enabled without Enhanced Citations, validated storage, and a valid effective policy/model configuration where applicable.
• Built-in structured PII rules, custom regex, and exact-value rules produce grounded findings; invalid/pathological patterns cannot hang a worker or return a clean verdict.
• Model selection reuses configured model connections rather than assuming a classic GPT endpoint. Malformed, refused, timed-out, or incomplete model results fail closed.
• Every required source unit is accounted for, including the last page/chunk, oversized units that require splitting, and configured boundary overlap. Partial or sampled coverage cannot be reported as a clean document scan.
• A late finding prevents publication of all earlier chunks from a new upload. An existing document is held when its scan starts and is blocked on cached and uncached access paths.
• Once a finding creates a review hold, a retry, apparently clean rescan, disabled rule, expired approval, or disabled feature cannot bypass the outstanding human decision.
• Baseline policies cannot be weakened by workspace additions. Review, policy, evidence, and job APIs enforce object-level authorization and the appropriate route security policies.
• Self-review works only for the new screening review type and authorized workspace roles; existing unrelated approval policies retain their behavior.
• Approve-with-flag keeps the warning and audit record. Remediation removes selected content from every released representation while leaving the retained original accessible only through authorized review.
• Stale approval/redaction requests, duplicate workers, crashes, concurrent reprocessing/deletion, and partial index writes do not publish unreviewed content or approve the wrong revision.
• Administrators can start and monitor selected/all-workspace scans with durable recovery and explicit skipped/incomplete coverage. Workspace managers can scan their authorized documents without gaining cross-scope access.
• Functional, route-policy, and Azure Playwright coverage exercise the real enforcement and review behavior in both interfaces. Documentation, generated app-surface inventory, and the implementation version are updated together.

Notes

• Related: Add PII detection for uploaded documents and chats #341 (document/chat PII), Message Alerts and Admin Workflow for Sensitive Content #375 (message alerts and remediation), Add configurable DLP/PII preflight policy framework for web search #992 (outbound web-search preflight), and [P1] Add formatting-aware document ingestion for strikethrough and font color #1142 (formatting-aware extraction).
• This issue owns the shared framework and document-first integrations. It does not claim to complete the related message, outbound web-search, or formatting-aware ingestion scopes.
• For the white-text scenario, this release analyzes extracted text regardless of appearance. Detecting font color, invisible layers, or other visual formatting itself remains part of the related [P1] Add formatting-aware document ingestion for strikethrough and font color #1142 work. Detection is a risk-reduction control, not a guarantee that all PII or prompt injection can be found.
• Reuse the existing approval/notification engine, shared model clients, and distributed job/lease patterns, but do not reuse permissive/truncating alert evaluation as an enforcement gate.
• Key integration areas: functions_documents.py, functions_content.py, functions_search.py, functions_search_service.py, route_backend_chats.py, route_enhanced_citations.py, document/tabular plugins, functions_approvals.py, background_tasks.py, settings/schema registration, and classic/V2 workspace/admin surfaces.
• Planning baseline: application version 0.261.105. Implementation must increment only the final version segment and keep new test/documentation headers consistent.