Skip to main content
CID222 Docs

Use the built-in AI chat

Chat with a model through the gateway itself — the same filters, sessions and masking that govern every other surface, and what an administrator can see about it.

  • Version: 0.4
  • Role: admin_user, normal_user
  • Type: task

Playground is the chat CID222 hosts itself. Every message on it passes the same input filter, the same detection pipeline and the same output filter as traffic from any application on the gateway, so it is both a usable assistant and the fastest way to see what your policy actually does.

What do I need?

Licence
Any
Role
admin_usernormal_user

Prerequisites

  • A provider credential is active for your account or one of its tenant groups. Without one there are no models to pick.
  • The appliance runs with `CID_ENABLE_LAB` set to `true`, or is an unlicensed development box — see the callout below.
  • Your account is not AI-locked by a security review.

Danger

The sidebar entry for this page lives in the Testing group, which is hidden on every licensed deployment. On a normal customer appliance there is no link to Playground, even though the page registry describes it as the page a normal_user is meant to live on. The route and its API are not licence-gated, so the page still opens if you type the address.

Two roles are refused outright. An auditor gets This role does not use the chat: an auditor reviews the estate rather than adding traffic to it. Use the dashboard instead. A viewer can read the page but every send, rename and delete is refused with READ_ONLY_ROLE, because chat runs real work and spends provider credit.

Hold a conversation

Open the page

Select Testing → Playground.

With no conversation open you see Welcome to the Playground and the line Every message passes the input filter before reaching the model. Four test prompts sit below it — Test PII detection, Test safety filter, Test jailbreak protection and Safe prompt (control) — and selecting one drops it into the composer.

Choose a model

Open the model picker in the header.

Each entry reads {model} · {provider}, and a model that accepts images carries an icon labelled Supports images. If the list shows No models available, no active credential resolves for your account or its groups.

Send a message

Type in Message the model… and press Enter. Shift+Enter starts a new line.

Sending with no conversation open creates one automatically, named from the first 50 characters of your message. The hint under the composer restates the rule: every message passes the input filter before reaching the model.

Read the response and its meta line

The reply appears as one message, not token by token.

Under each message you see the time, Filter: {n} ms, the model name, the token count for that turn, and the model and output timings. A copy button beside the reply confirms with Copied to clipboard.

Manage your conversations

Use the Conversations panel on the right: Search conversations to filter by name, the row menu to Rename conversation or Delete conversation, and New conversation in the header to start again.

Deleting asks Delete session? and warns This will permanently delete this session and all its messages. This action cannot be undone.

Warning

The response arrives in one piece rather than streaming, and there is no Stop button — a long answer cannot be cancelled from the page. The conversations panel is also hidden below tablet width with no replacement, so on a phone you cannot switch conversations.

What the filters do to your message

The pipeline is the product's ordinary one: language detection, evasion decoding, then PII, 13-label toxicity and jailbreak detection in parallel, then your tenant's and your groups' filter overrides, then a single decision with REJECT beating MASK beating FLAG.

VerdictWhat the model receivesWhat you see
FLAGThe message unchangedNothing at all. Only the Filter: {n} ms chip hints that a filter ran
MASKNumbered placeholders such as [EMAIL_1] in place of the valuesYour own message bubble is rewritten in place to show the placeholders
REJECTNothing — the request never leaves the applianceYour message is replaced by a red [MESSAGE REJECTED] bubble tagged Rejected, with the reason under it

Warning

A rejection produces no toast in 0.4. The bubble you typed disappears, the page retries the history for about a second, and then the red [MESSAGE REJECTED] message appears. A flagged message produces no visible signal whatsoever.

The reply is filtered too. A blocked reply raises Response blocked with the reason and is stored as [RESPONSE BLOCKED]; a flagged reply raises Response flagged and is still shown; a masked reply simply arrives with placeholders in it and no marker at all.

If the output filter itself crashes, the response is delivered unfiltered — the design fails open there deliberately, and only the server log records it.

Reversible masking

Masking is normally one-way: the model sees [EMAIL_1], and so do you. CID222 can restore the original values in the reply on its way to your screen.

  • Each masked value keeps one numbered placeholder for the whole conversation, so turn three cannot mint an [EMAIL_1] that collides with turn one's.
  • The placeholder-to-value map is encrypted with AES-256-GCM using PII_MAP_ENCRYPTION_KEY and is the only place the product stores original values at rest. It is deleted with the conversation.
  • Restoration happens after output filtering and only on the copy streamed to you. The stored transcript stays masked, so real values never go back to the model on a later turn, and reloading the page shows the masked text again.

Note

Restoration is off for everybody by default and is enabled per appliance, per tenant or per tenant group in the runtime configuration — an explicit setting on your account beats a group one. With PII_MAP_ENCRYPTION_KEY unset or malformed, the map is never written or read and replies simply stay masked. That is the fail-closed state, not an error, and nothing on the page tells you which mode you are in.

Attach an image or a document

The attachment button appears only when the selected model accepts images. A document also needs a vision-capable model selected before the control is offered, even though documents reach the model as text.

JPEG, PNG, GIF, WebP, BMP, TIFF and ICO, up to 10 MB. The Image Analysis dialog runs OCR and detection before anything is sent, showing Extracted Text, PII Detected and Safety Issues with a per-entity action, and lets you compare Show Original with the redacted version. Leave Send {redacted} image to AI for analysis ticked to send the redacted copy.

A rejected image cannot be sent — the dialog states The image cannot be sent to the AI assistant. and offers no send button. If the analysis service is down, the dialog offers Send Without Analysis, which sends the original, unredacted image.

Warning

The stated 50 MB document limit is optimistic. The file is sent base64-encoded inside a JSON body against a 50 MB body limit, and encoding inflates it by about a third, so the practical ceiling is closer to 37 MB — above which the upload is refused with a message that still says 50 MB.

Chunked and resumable uploads are a different subject: they belong to the interception surfaces, where CID_RESUMABLE_UPLOAD_POLICY defaults to block. This page sends a whole file in one request and never meets that path.

Context, summarization and tokens

Two histories exist per conversation. The transcript you read grows without limit. What actually goes to the model is a bounded copy: once it passes the configured token threshold — 4000 tokens by default — the appliance replaces the older turns with a generated summary and keeps the last three messages.

The Context window meter above the thread shows this, reading {used} / {limit} tokens · {n} until summarization, and turning red past 90 percent. It shows summarized once the threshold is crossed.

Warning

Summarization needs its own provider key in the runtime configuration. Without one it fails silently: the meter pins at full, the full context keeps going to the provider, and nothing tells you. The module READMEs also describe a different scheme — 80 percent of the model's context window and four preserved exchanges — which the code does not implement.

The token chip in the header shows the running total and estimated cost for the conversation, with a LIVE tag while a reply is in flight and a breakdown of Total, Prompt, Completion and Est. cost on hover. If the provider returns no counts it reads 0 (Backend).

Prompt compression and model routing can both act on a message here, but the page does not surface either — a request quietly routed to a cheaper model looks identical. The saving shows up on Token cost and savings.

What administrators can see

No administrator can read your conversation. There is no administrative endpoint anywhere in the gateway that reads a session transcript, and every session query is scoped to the account that owns it — somebody else's conversation returns the same "not found" as one that never existed.

What is visible elsewhere:

PageWhat it shows about this chat
All detectionsOne row per policy hit, with the entity type, the action taken and a hash of the message — not the message
Event logsThe audit trail around the activity, not its content
Tenant analyticsAggregate volume, tokens and cost per account

Warning

A detection row stores the matched value itself — the actual address, national id or card number — alongside its type and confidence. An admin_user or superadmin reading All Detections therefore sees the sensitive field, though never the surrounding message. The auditor role is the exception: those values are replaced with the masked form or a bare type placeholder before the row reaches an auditor.

Deleting a conversation cascades to its detection rows, so a user can remove the evidence of their own policy hits. Plan retention accordingly.

If your account is paused

A security review of repeated policy violations can pause AI access. The composer is then replaced by AI access is paused on this account, with the reason and Only an administrator can lift it. Select Request unlock, optionally explain, and select Send request — you may send up to three requests an hour.

A softer outcome is a warning strip above the composer reading that your recent activity was reviewed and further attempts may suspend AI access. The reply still arrives.

Verify

  1. Send the Safe prompt (control) test prompt. A reply arrives and the token chip advances.
  2. Send the Test PII detection prompt. Your own bubble is rewritten with placeholders, and Event logs records MESSAGE_MASKED for it. The same hit appears on All detections.
  3. Send the Test jailbreak protection prompt against a policy that rejects it. The red [MESSAGE REJECTED] bubble appears and MESSAGE_BLOCKED is recorded.
  4. A flagged-only detection writes PII_DETECTED with no visible change in the chat.
  5. A filtered reply writes RESPONSE_MASKED or RESPONSE_PII_FLAGGED; an analysed image writes IMAGE_ANALYSIS_DETECTION.

If it fails

  • The model picker shows No models available — no active credential resolves for your account or its tenant groups. An administrator adds one on Credentials.
  • Failed to send message with No active credential found for tenant … and provider … — the picker is still on its default selection for a provider you have no key for. Choose a model that is actually listed.
  • Failed to send message carrying the provider's own wording — the provider refused the call. Rate limits, expired keys and provider outages all surface verbatim; CID222 does not translate them.
  • This role does not use the chat: an auditor reviews the estate rather than adding traffic to it. Use the dashboard instead. with ROLE_NOT_FOR_CHAT — sign in with an account that uses the gateway.
  • This is a read-only demo account (viewer role) — actions and changes are disabled. with READ_ONLY_ROLE — the viewer role may read this page but not send.
  • CID license is expired or invalid. An administrator can install a renewal in the dashboard under Settings → License. with LICENSE_EXPIRED — chat is blocked until the licence is renewed.
  • Invalid image / Invalid document — the file type or size was refused before any upload. The refusal names the limit it broke.
  • Document text extraction failed — the document is referenced in your message but its content could not be read.
  • Failed to harden prompt — the prompt-hardening button needs an Anthropic credential specifically. It is shown on every tenant, including those with no Anthropic key.

Next steps

  • Security filters — the rules that decided what happened to your message.
  • All detections — every policy hit from this chat and every other surface, in one timeline.
  • Credentials — the provider keys that decide which models appear in the picker.

Last updated on

On this page

Download PDF