The Knowledge tab under Incidents logs every guardrail hit raised while your indexed content was scanned — a check on document text that a Knowledge control caught before or as it became searchable.

What raises a Knowledge incident

A Knowledge incident is written whenever a Knowledge control fires against indexed content. Unlike Chat controls, Knowledge controls only read one input — the knowledge content itself — so every incident on this tab traces back to something found in a document, not a conversation.

What the list shows

Filter by Status, Action, Policy, or a Detected date range.

Restricted vs. Flagged

Restricted means the matching content was hidden from search results — users can no longer retrieve it through Enterprise Search. Flagged means the content stayed searchable but the hit was logged here for review. Flagged Knowledge incidents are worth checking first, since the content in question is still reachable by users.

Reviewing the matched content

Open an incident to see the exact matched content the control found in the indexed source, along with a note pointing you back to the source system for the full, unredacted version. The Control violated section links back to the specific control and the policy it's part of, so you can tune the check or adjust which sources the policy covers.

Triaging a Knowledge incident

Set the Status, assign an owner, and add Notes, then click Save. If a control is repeatedly restricting content that should be searchable, mark those hits False Positive and revisit the control's check or the policy's source list.