@@ -50,7 +50,7 @@ A Kubernetes App connects an in-cluster agent to AI SRE. After installation, AI
     Go to **Plugins → Apps → Kubernetes Apps** and click **Create Kubernetes App**. Enter a cluster name and choose its scope: **Shared** is available to all sessions in the account; **Team** is available to that team's sessions and to personal sessions of its members. Cluster names must be unique within a scope.
   </Step>
   <Step title="Set namespace access">
-    Choose **All namespaces** or **Specific namespaces**. All namespaces applies one permission level to current and future namespaces. With specific namespaces, set **Read-only**, **Read + limited modifications**, or **Full access** for each namespace. Leaving the specific-namespace list empty allows the agent to read only basic cluster metadata. **Full access** means unrestricted cluster administrator access: on a specific namespace it applies only inside that namespace (cluster metadata stays read-only), while **All namespaces + Full access** grants `cluster-admin` via a `ClusterRoleBinding`, including cluster-scoped resources and cluster RBAC (available only with All namespaces). Open **View Kubernetes RBAC details** in the form to see exactly what each level allows.
+    Choose **All namespaces** or **Specific namespaces**. All namespaces applies one permission level to current and future namespaces. With specific namespaces, set **Read-only**, **Read + limited modifications**, or **Full access** for each namespace. Leaving the specific-namespace list empty allows the agent to read only basic cluster metadata. **Full access** is the highest level within the namespace: on a specific namespace it applies only inside that namespace (cluster metadata stays read-only), while **All namespaces + Full access** grants `cluster-admin` via a `ClusterRoleBinding`, including cluster-scoped resources and cluster RBAC (available only with All namespaces). See [Permission details](#permission-details) below for what each level can do; open **View Kubernetes RBAC details** in the form for the complete RBAC rules.
   </Step>
   <Step title="Run the installation command">
     Save the App, copy the generated installation command, and run it in the target cluster. Installation commands expire; reopen the installation setup or view the manifest to generate a new command without rotating the token.
@@ -61,6 +61,32 @@ A Kubernetes App connects an in-cluster agent to AI SRE. After installation, AI
 After changing namespace access or permissions, run the installation command again so the in-cluster RBAC is updated. Before choosing **Read + limited modifications**, confirm that AI SRE is allowed to perform those actions in the namespace. **Full access** is a high-risk option: on a specific namespace it lets this App read, create, modify, and delete every resource in that namespace; **All namespaces + Full access** escalates to cluster administrator access (`cluster-admin`), so choose it with care.
 </Warning>
 
+### Permission details
+
+The following boundaries apply to all levels:
+
+- Every level can read cluster information, nodes, Pods, events, logs, and non-sensitive resources such as ConfigMaps
+- No level supports entering a container (exec), Attach, port forwarding, or watch and real-time log following (`-f`). This is a limitation of the access method, not of the permission level
+
+Operations that differ between levels:
+
+| Operation | Read-only | Read + limited modifications | Full access |
+| --- | --- | --- | --- |
+| Read Secrets | No | No | Yes |
+| Evict Pods (to restart workloads) | No | Yes | Yes |
+| Scale Deployments and StatefulSets | No | Yes | Yes |
+| Adjust HPA replica bounds | No | Yes | Yes |
+| Roll back workloads | No | No (AI SRE computes the target revision and gives you the complete command to run) | Yes |
+| Modify workload configuration (image, startup command, env vars, etc.) | No | No | Yes |
+| Modify ConfigMaps and Secrets | No | No | Yes |
+| Create or delete resources | No | No | Yes |
+| Modify RBAC within the namespace | No | No | Yes |
+| Operate cluster-scoped resources and cluster RBAC | No | No | All namespaces only |
+
+- **Read-only**: read access within the authorized namespaces is bound directly to Kubernetes' built-in `view` role — FlashDuty no longer maintains its own resource list. It covers Pods, logs, workloads, events, ConfigMaps, and similar resources, but never Secrets; CRDs that cluster components mark as view-readable are included as well. It also grants read-only access to cluster-level nodes, namespaces, persistentvolumes, storageclasses, and ingressclasses.
+- **Read + limited modifications**: on top of read-only, this level may evict Pods (`pods/eviction`), scale Deployments and StatefulSets (`deployments/scale`, `statefulsets/scale`), and adjust HPA replica bounds (`horizontalpodautoscalers`). These rules can only change how many replicas a workload runs and rebuild Pods from the same configuration — they cannot change any Pod's image, startup command, environment variables, identity, or mounts. As a result, `kubectl rollout restart` and `kubectl rollout undo` are both denied (in Kubernetes both are patches to the workload); restart a workload by evicting its Pods one at a time. For rollbacks, AI SRE derives the target revision from the ReplicaSet history and gives you the complete `kubectl rollout undo --to-revision=N` command to run in your cluster.
+- **Full access**: can read Secrets, modify ConfigMaps and Secrets, modify workload configurations, create or delete resources, and modify RBAC within the namespace; **All namespaces + Full access** additionally grants `cluster-admin` via a `ClusterRoleBinding`, covering cluster-scoped resources and cluster RBAC.
+
 ### Edit and revoke
 
 You can edit the cluster name, scope, and namespace access from the Kubernetes App list. Changing the scope to **Shared** carries the same gate as creating a Shared App: only the account owner or admins can do it — a regular member is denied even for their own team's App and can only move an App to teams they belong to. Revoking immediately invalidates the connection and token, but it does not remove the in-cluster agent or RBAC automatically. Run the uninstall command shown by the console in the target cluster. It removes only resources for this Kubernetes App and preserves the shared `flashduty` namespace.
 
@@ -4,6 +4,27 @@ description: "This page documents important updates and feature releases for Fla
 keywords: ["Changelog", "Product Release", "Feature Updates", "Flashduty", "Version History"]
 ---
 
+<Update label="2026-08-18" description="🔧 Kubernetes App permission details update and quick-silence label exclusion rules">
+
+### Kubernetes App permission details update
+
+The Kubernetes App permission matrix has been updated to clarify what each level can do:
+
+- No level supports entering a container (exec), Attach, port forwarding, or watch and real-time log following (`-f`) — a limitation of the access method, not of the permission level
+- **Read + limited modifications**: now limited to evicting Pods to restart workloads, scaling Deployments and StatefulSets, and adjusting HPA replica bounds; `kubectl rollout restart` and `kubectl rollout undo` are denied (both are patches to the workload in Kubernetes) — restart by evicting Pods one at a time
+- **Read-only**: read access within the authorized namespaces binds directly to Kubernetes' built-in `view` role, covering non-sensitive resources such as Pods, logs, and ConfigMaps, but never Secrets
+- Rollback: under Read-only and Read + limited modifications, AI SRE derives the target revision and gives you the complete command to run
+
+### Quick-silence label exclusion rules
+
+Labels that hit an exclusion rule no longer participate in quick-silence matching conditions, so similar alerts are not left unsilenced:
+
+- New account-level configuration: **Organization Profile → Fault Handling → Quick-silence excluded labels**; when creating a quick silence you can see each excluded label and its reason (JSON / Numeric / Datetime / Too long / Globally excluded / Owning integration)
+- Maintain per-integration excluded label lists and toggle system format rules (json / datetime / numeric, all enabled by default); the global blacklist is system-curated and cannot be configured
+- Only the subject account or Account.Admin can modify the rules; other members view them read-only. Changes take effect only for silences created afterwards
+
+</Update>
+
 <Update label="2026-08-17" description="🔎 Structured monitoring datasource queries (monit-query data)">
 
 ### Structured monitoring datasource queries
 
@@ -377,7 +377,9 @@ After selecting an entity definition, group, and data source, the workspace prov
 
 The Entities tab shows at most the first 200 entities; when more match, the page reports that only the first 200 are shown and asks you to narrow the filters.
 
-Select **View details** for an active alert to inspect its entity source, rule, alert dimensions, labels, and notification status. During troubleshooting, first confirm the data source and current group at the top of the page, then check the rule's source group and effective policy scope.
+On the **Rules** tab, click a rule's name to open its drawer directly: rules owned by the current group open the **Edit** drawer, and rules inherited from a parent group open the **Override** drawer — the same behavior as [deep-linking directly to a rule](#deep-link-directly-to-a-rule). If your account lacks entity-tree management permission or rule management permission for the group, the page shows a permission toast and does not open the drawer.
+
+Click an active alert row (or the **View details** button inside it) to inspect its entity source, rule, alert dimensions, labels, and notification status. During troubleshooting, first confirm the data source and current group at the top of the page, then check the rule's source group and effective policy scope.
 
 The active alerts tab provides a filter bar with **Severity** and **Rule** (searchable dropdown) filters. Under **More filters** you can enter an **Exact entity key** (or click an entity key directly in the table). After selecting a rule, you can also filter by **Effective policy scope** to locate the policy scope a rule actually adopts through inheritance or overrides. When filtering by multi-value labels hits the scan limit, the page reports that the current page's results are incomplete; narrow the group or other filters and retry.
 
 
@@ -311,12 +311,14 @@ Quickly create temporary silence rules based on existing incidents.
 - Effective scope is the incident's channel (cannot be changed)
 - **One-time silence** is selected by default and lasts 1 day. You can type a custom duration in the left input box (formats such as `30m`, `1h`, `12h`, `1d`, `1w`, `2w` are supported) or pick an absolute time range on the right. A one-time rule is automatically deleted after expiration
 - You can instead select **recurring silence** and configure the silenced time windows with the standard recurring schedule
-- Conditions default to severity and filtered label matching (automatically excluding numeric, overly long, and special labels)
+- Conditions default to severity and filtered label matching. Labels are automatically excluded in two ways: **system format rules** (label values that are JSON, numeric, datetime-formatted, or overly long) and **account exclusion rules** (globally excluded labels and per-integration excluded labels — see [Quick-silence label exclusion rules](/en/platform/organization-info#quick-silence-label-exclusion-rules))
 
 <Frame caption="Quick Silence Configuration">
   ![Quick Silence](https://docs-cdn.flashcat.cloud/images/png/e80c2632d9065b28499edfa5a81a8505.png)
 </Frame>
 
+When creating a quick silence, the drawer shows "N labels identified, M labels automatically excluded" and lists each excluded label with its reason: system format rules are marked as **JSON / Numeric / Too long / Datetime**, account rules as **Globally excluded** or the owning integration name. From the drawer you can click **Manage exclusion rules** or **View exclusion rules** to open the account configuration (only the main account or Account.Admin can modify it; other members can view it read-only). The matching conditions are generated automatically from the source incident's labels — conditions that are too precise may cause similar alerts to escape silencing, so review the list carefully before creating.
+
 <Note>
   When repeatedly using quick silence on the same incident, it edits the original rule rather than creating a new one.
 </Note>
 
@@ -99,6 +99,18 @@ When snoozing incidents in the console or IM cards (Feishu/Lark, DingTalk, WeCom
 
 Click **Save** to apply changes, which take effect immediately in the console and IM cards. Only the subject account or Account.Admin can edit; other members see the current presets as read-only text. See [Snooze](/en/on-call/incident/handle-update-incident) for more snooze operations.
 
+### Quick-silence label exclusion rules
+
+When you create a [quick silence](/en/on-call/channel/noise-reduction#quick-silence), the matching conditions are generated automatically from the incident's severity and labels. Labels that hit an exclusion rule do not participate in the matching conditions, so labels whose values change on every occurrence (trigger value, current value, links, etc.) don't end up in the conditions and cause similar alerts to escape silencing.
+
+**Where to configure**: Organization Profile → Fault Handling → **Quick-silence excluded labels** (the configuration dialog is titled "Quick-silence label exclusion rules"). Only the subject account or Account.Admin can modify the rules; other members can open and view the current rules (exclusion rules affect the silences they create, so they need visibility). Changes take effect only for quick silences created afterwards.
+
+Configuration contents:
+
+- **Per-integration exclusion lists**: maintain an excluded label list for each integration separately. When creating a quick silence, a label hitting any exclusion list is excluded
+- **System format rule toggles**: `json` (JSON values), `datetime` (datetime format), and `numeric` (numeric values), all enabled by default; label values longer than 235 characters are also excluded automatically (cannot be disabled)
+- **Global blacklist**: about 95 system-curated labels (such as `trigger_value`, `current_value`, `detail_url`, `query`) are always excluded; they are maintained as a frontend constant and cannot be configured
+
 ## Related Topics
 
 ---