Security Controls for Citation Popups (Data Leakage Prevention)
We want to bring this to the attention of the customer and administrator community to see if anyone has encountered this and found a workaround, and to request official security configuration controls from the Moveworks product team.
When an employee clicks on a citation in a chat response, Moveworks generates a public-facing URL (https://app.moveworks.ai/readChatResponsePopup/...) displaying raw text chunks and snippets extracted from internal tickets, proprietary documentation, and knowledge bases.
While these links use cryptographically obscured parameters and expire after 5 minutes, they raise a few compliance and data-governance concerns for our security team:
-
No Authentication Check: Anyone who holds the URL can view the snippet during that 5-minute window without signing into corporate SSO/IdP or the Moveworks tenant.
-
Bypasses Source ACLs: If a citation is pulled from a source with restricted permissions (e.g., sensitive HR or IT knowledge bases), an accidental or shared link allows unauthorized viewers to see content they might not have permissions to read directly.
-
DLP Considerations: For organizations with strict Data Loss Prevention policies, unauthenticated endpoints hosting internal data excerpts represent an audit and governance risk.
We would like to request administrative options to secure these links, such as:
-
Enforce SSO/IdP Authentication: Require an active authenticated session before the citation popup displays content.
-
Direct Source Redirection: An option to bypass the Moveworks preview page entirely and link users directly to the native source system URL (relying on the destination system’s existing access controls).
Questions for the community:
-
Has anyone else evaluated this with their security or compliance teams?
-
Have you found a practical workaround to mitigate this?
-
Moveworks Team: Is direct source linking or SSO enforcement on popup endpoints on the near-term roadmap?