FAQ: security, masking and traffic analysis
39 direct answers about controls, decisions and common errors.
Use the contents or question search. Each answer links directly to the control and its detailed instructions.
How do I disable masking?
verdict_classes does not disable replacement; it changes rediscovery. Change the targeted policy action and verify the final decision, key mode and other active rules.
How do I disable traffic analysis?
Stopping refresh, feeds or alerts does not stop inspection. Choose the intended mechanism: policy action, Router key mode, export or content capture; there is no shared switch for them.
How do auto and verdict_classes differ?
Auto searches known private values again; verdict_classes uses initial verdict classes. Both can replace values. off/false compatibility flags mean verdict_classes.
What is KEY_N and why do placeholders change?
KEY_N is a replacement-dictionary token. Stability depends on masking session, owner, TTL and storage. Use the supported session_id for conversations; another or expired session can have a different dictionary.
Why did masking become a block or on-prem route?
The verdict may be unreplaceable: substituting values cannot remove confidential meaning. Containment escalates; an unavailable private destination can lead to blocking. Check reason and providers.
How do I handle a DLP or injection false positive?
Find request ID, verdict, point and winning rule; reproduce with a synthetic anonymized example. Refine the detector or narrow scope on staging and retest positive/negative cases. Do not disable all protection for one record.
Why is original text missing in audit?
Metadata can be stored without raw content. Check capture enablement, read permission, retention and the separate store. Enabling capture now cannot reconstruct previously uncaptured or pruned text.
Does zero-day retention disable audit logging?
No. Zero disables automatic pruning, not new decision logging. Masking-session TTL and original-content retention are separate.
Does Pause or Off turn protection off?
In reports these stop display/refresh. Pausing a Secure policy removes that policy from decisions while others remain. Check which object the control belongs to.
Why does a report show no events?
Check tenant, UTC window, filters, source and actual traffic. Ring buffers are size/restart-limited. A 503 means the source is unavailable, not that no threats exist.
What should I do on 401 or 403?
401: renew the session or check inference-key validity, expiry and revocation. 403: check role, tenant scope and edition entitlement. A /v1 key does not replace an admin console session.
Why do settings fail to save with 422?
The server rejected the document. Read the error for action, condition, scope or missing fallback. Compare JSON against the canonical contract; older form values can differ. Rejected writes are not applied.
Why is a section or edit button missing?
Check user role, edition/license and configured components. Documentation does not grant permissions or enable Preview runtime. Ask your organization administrator for the required access.
Does DLP continue if alerts or webhooks are disabled?
Yes. Alert rules count events and subscriptions deliver them. Inspection, policy enforcement and audit logging are separate mechanisms.
Why are webhook events not delivered?
Check enabled state, subscribed events, receiver URL and signature verification. Inspect HTTP response/errors in deliveries; ping/replay really send events. Alert generation does not prove receipt.
How do I configure classifier timeout or circuit breaker?
Operators configure these service parameters; Classifier Health reports state/history. Specify the desired value and unit, then qualify failure/recovery and request decisions on staging.
Why can’t a client weaken masking?
Router clamps the final mode to floor. With floor=auto a verdict_classes request becomes auto. Check Minimum protection and the response mode header.
How does strict differ from external_unrestricted?
Strict applies classification/policy; external_unrestricted sends externally without Secure screening. It changes protection while retaining authentication, quotas and billing.
Where do I enable external_masked?
Current UI offers two modes. The server contract supports the third through its supported key-management API in compatible versions; there is no third form button to click.
Why did the request use another model?
Allowed perimeter/provider availability come before model preference. Check rule order, action/perimeter, weights and breaker. Client model hints cannot lower privacy.
What are Max out, Max prompt, 413 and 429?
Max out caps output tokens; Max prompt caps prompt characters and returns 413 when exceeded. For 429, check RPS/Burst and traffic kind in Quotas. Monthly max_requests/max_cost_usd are separate. These forms do not configure RPM/TPM or daily budgets; zero removes the specific per-request cap.
Why is thinking missing from history?
Requires a model that returns reasoning and storage of that content. reasoning_effort sets model effort; the client value wins. Storage settings do not create thinking.
Are Workflows, WASM and E2EE always available?
These Preview sections are normally hidden and need an agent-runner/runtime. Their presence in an educational screenshot does not prove availability in your deployment.
Why is a worker task absent from Router requests?
They are separate sources. Use Client tasks for job IDs and Router requests for direct /v1 calls. Success in one source does not prove behavior in the other.
How do I enable external_masked when the form does not list it?
An administrator reads GET /admin/keys, finds the test key id, PATCHes /admin/keys/
Which content_type values does a Router policy accept?
GENERAL, CODE, ARCHITECTURE, RESEARCH; an empty list matches any. These are classifier categories, not MIME types. Some form values text/json/image/audio/document may return 422; use the canonical JSON list and check the actual verdict.
How do I set 10000 requests and USD 50 per month?
Quotas → Add quota → your Tenant ID → Monthly requests: 10000 → Monthly cost USD: 50 → Warning: 80 → Add. For an existing record use Edit → Save. Check PostgreSQL active and reread the row after Refresh.
Why does RPS = 0 behave differently in the two forms?
Tenant limits accepts RPS 1–1000; Burst 0 selects RPS × 2. The separate Tenant request limits form permits RPS 0 for unlimited. Deleting an override restores the global limit, rather than unlimited. Do not transfer zero semantics between forms.
Why is a quota visible but cannot be saved: file-only?
File quotas can be read without PostgreSQL; override writes/deletes require storage. Have the operator restore it, then save and reread. Refresh does not reset usage; Reset usage is a separate action allowing budget to be consumed again.
Does warning threshold 0% disable warnings?
No: gateway warn_at_pct=0 means the 80% default. The form stores 80% as 0.8. Control individual notifications through Enabled in Alert Rules/webhooks; negative file/API warning values belong to the operator contract, not the 0–100% form.
Customer created but invitation missing — create again?
First refresh Customers administration: saving the account and sending email are separate stages. If the record exists, repair delivery and Send invitation from that record. Avoid duplicates. Notify about saved settings sends a separate message; enabling notifications alone sends nothing.
How do I temporarily deny and restore customer access?
Customers administration → customer row → disable Access enabled → Save settings. Reread and verify denial of the customer session/key. Re-enable, save and sign in to restore. Tenant filters and disabled email notifications do not deny access.
How do I confirm a setting actually took effect?
After Save, Refresh or GET the object and compare server-returned values. Run a synthetic request and check its request ID/action in audit. For notifications also check deliveries and the receiver. Runtime configuration does not guarantee persistence across restart without the corresponding store.
Where can I edit the execution chain in Workflows?
The current Preview form only exposes a name and creates a workflow record. There is no graphical chain editor. Configure the plan/execution through the supported agent-runner API and verify a completed runtime test, not just a card.
Why does WASM Upload plugin not open a form?
The current Preview uploader is not implemented. Deliver manifest.json, plugin.wasm and signature through the supported agent-runner operator workflow. Registering an artifact does not automatically enable routing or DLP execution.
Tenant wizard failed — can I retry it?
Inspect Access keys and Quotas before retrying: the wizard may have created a key before a later failure. Check tenant/limits and avoid issuing extra secrets; revoke an unwanted key. Key/quota creation does not replace a separate customer SSO invitation.
How do I access operator Clients and Groups?
Use the normal IAM.Identity sign-in with a profile already granted Router / LLMOps operator access. IAM.Market permissions do not automatically grant Router permissions. A gateway admin token or inference key does not replace an LLMOps session. Open Groups, reload the page and verify access persists. Operator sign-in steps.
Why did the top tenant selector not select the routing policy?
The top selector supports navigation and history filtering. Policy has its own Tenant ID field: enter it, click Load and inspect the document tenant label. An inherited document can contain tenant_id: "*"; saving a tenant override requires matching path and body tenant IDs. A tenant_mismatch response means the edit was rejected. Do not select the global tenant to bypass this error.
Why is a saved Router policy not visible on every request immediately?
Multi-replica Router refreshes PostgreSQL overrides in the background. Another replica may briefly retain the previous document. On staging on 2026-10-15, both replicas read the same owned override after propagation; the global policy remained unchanged. Read back after the configured interval and check version and a new request. If replicas do not converge, give the operator the tenant, version and time; repeated saves do not replace replica checks.