Add quilr-web release notes for 04ea9d7ac

docs/platform-areas/findings.md

@@ -36,6 +36,23 @@ platform. It is the main place to move from summary signals into detailed eviden
 - Review Compliance Findings by provider, detection scope, user, category, and subcategory.
 - Open related Quilly coaching conversations from finding cards where a **Quilly** badge is shown.
   See [Quilly](./quilly.md) for details on reviewing engagement history.
+- Review masked evidence snippets for data-risk findings and reveal them with the **Mask/Unmask**
+  toggle when permitted.
+
+## Masked Evidence Snippets
+
+Data-risk evidence — including copy/paste content and snippets from uploaded or downloaded files —
+is masked by default when reviewed from a finding. Each masked value is shown as a labeled pill (for
+example, a sensitive-data category name) instead of the underlying value, whether you are viewing a
+single snippet or the **All Snippets** view.
+
+Admins with AI Usage Conversation read access can use the **Mask/Unmask** toggle on a snippet view to
+reveal the original values:
+
+- Unmasking applies to every snippet shown in that view in one action, rather than one request per
+  snippet.
+- Each unmask action is recorded against the finding under review, so audit history reflects one
+  entry per action instead of one entry per snippet.
 
 ## Finding Insights Time Ranges
 
@@ -88,4 +105,5 @@ to inspect the source and content evidence.
 
 Findings require access to the Findings resource. Endpoint-specific tabs are shown only when the
 endpoint agent capability is enabled for the tenant. Compliance findings depend on configured
-compliance integrations and the related Compliance permissions.
+compliance integrations and the related Compliance permissions. Revealing unmasked values in
+data-risk evidence snippets requires AI Usage Conversation read access.

docs/platform-areas/quilly.md

@@ -75,6 +75,8 @@ finding and user.
 
 ## Access Requirements
 
-The **Super Admin** role is required to view Quilly engagements in the platform.
+The **Admin**, **Platform Admin**, or **Super Admin** role is required to view Quilly engagements
+in the platform, including the Quilly badge on finding cards, the Quilly Engagements drawer, and
+the Quilly Engagement tab in User Lens.
 
 End-user coaching delivery requires configured **Slack** and/or **Microsoft Teams** integrations.

docs/release-notes/index.md

@@ -8,6 +8,31 @@ hide_copy_dropdown: true
 
 # Release Notes
 
+## July 23, 2026
+
+### New
+
+- [Findings](/platform-areas/findings): Data-risk evidence snippets — copy/paste content and
+  snippets from uploaded or downloaded files — are now masked by default when reviewed from a
+  finding, with sensitive values shown as labeled pills. Admins with AI Usage Conversation read
+  access can use a **Mask/Unmask** toggle to reveal original values in the snippet view and in the
+  **All Snippets** view.
+
+### Improved
+
+- [Findings](/platform-areas/findings): Unmasking multiple evidence snippets in one view now sends
+  a single batched request instead of one request per snippet, and each unmask action is recorded
+  against the finding under review so audit history stays consolidated rather than fragmented
+  across snippets.
+- [Quilly](/platform-areas/quilly): Access to Quilly engagements — the Quilly badge on finding
+  cards, the Quilly Engagements drawer, and the Quilly Engagement tab in User Lens — is now
+  available to the **Admin** and **Platform Admin** roles in addition to **Super Admin**.
+  Previously this required the Super Admin role.
+- [Users, Applications, and Accounts](/platform-areas/users-accounts-applications): The
+  **Pending bulk actions** indicator on the Applications table no longer briefly shows a
+  "Checking bulk actions..." loader on initial page load or during background polling. The loader
+  now only appears while actively waiting on a bulk action the admin just started watching.
+
 ## July 16, 2026
 
 ### New