UX Spec: Data Spillage Handling — Download Quarantined Message Report

Links

1. Overview

1.1 Problem Statement

Content Reviewers who resolve quarantined messages in Mattermost's Data Spillage Handling system currently have no way to export a compliance report of the incident. When a reviewer permanently removes a quarantined message, the content is irrecoverable — yet DoD spillage response doctrine (NIST 800-53 IR-9, CNSSI 1001) requires documented incident records. Reviewers need the ability to download a structured report before taking irreversible action, ensuring an audit trail exists outside the platform.

1.2 Feature Summary

This addendum introduces a Download Report capability for Content Reviewers. Reviewers can download a compliance report (ZIP archive) of any quarantined message from three entry points: (1) directly from the RHS detail view at any time, (2) as part of the Remove Message flow with a mandatory download-before-delete safeguard, or (3) during the Keep Message flow. When downloading during removal, the system enforces a 2-step process — the report generates and downloads before the reviewer can permanently delete the message, ensuring the record is preserved. The report contains the full message text, all file attachments, incident metadata, timeline, and reviewer resolution details — providing a complete incident package for downstream investigation.

1.3 Scope

In Scope:

• Download report button in RHS detail view

• Download report checkbox in Remove Message and Keep Message modals

• 2-step Remove flow: generate report -> download -> confirm deletion

• Report generation loading, success, and error states

• ZIP archive report containing message text, file attachments, edit history, and incident metadata

4. End-User UX Flows

4.1 Direct Download from RHS

A new Report row appears in the RHS quarantined message detail view, positioned between "Posted at" and "Actions". It displays a "Download report" link button (blue text with a download icon).

Clicking the button triggers server-side report generation. While generating, the button text changes to "Generating report..." (disabled). On success, the ZIP archive auto-downloads to the reviewer's device and the button resets. On failure, the button text changes to "Failed. Try again." (destructive red) and resets to its default state on click.

This action is available regardless of resolution status — the reviewer can download the report whether the quarantine is Pending, Reviewer Assigned, Removed, or Dismissed. For resolved quarantines, the report includes the resolution details. For unresolved quarantines, the resolution section is marked "Pending Review."

Report filename: Uses an opaque pattern (mm-report-{hash}.zip) where {hash} is a server-generated opaque identifier (not a content hash) to prevent incident metadata inference from the filename — important for classified environments with shoulder-surfing risk.

4.2 Remove Message + Download (2-Step Flow)

When the reviewer clicks Remove message in the RHS, the confirmation modal appears.

All modals in this flow share a consistent context header:

• Body text with context: "You are removing a message by @{Author} posted in ~{Channel}, and quarantined for review by @{Reporter}.
  Once you remove it, the message will be deleted from the channel and a notification will be sent to the reporter. This action cannot be reverted."

Step 1 — Remove Message Modal

Title: "Remove message from channel"

The modal displays the context header, an Add Comment (optional) field with rich text formatting toolbar (bold, italic, link, more), and a checkbox: "Download quarantined message report".

When checkbox is checked (default):

• Buttons: Cancel | Continue (primary blue)

• Clicking Continue advances to Step 2

When checkbox is unchecked:

• The "Continue" button changes to "Remove message" (destructive red)

• Clicking it removes the message immediately — same as current behavior, no Step 2

Step 2 — Download Report Flow

When Step 1 is submitted with the checkbox checked, the system captures the resolution intent metadata (resolution intent, reviewer identity, timestamp, comment) and generates the report. The modal transitions through the following states:

Button color progression — "Remove permanently":

State 1 — Loading

Title: "Remove message from channel"

A Section Notice appears below the body text:

• Icon: Spinner

• Title: "Generating report..."

• Body: "Please wait for the report to download before you remove the message permanently. There will be no way to recover the message contents once it is removed."

Footer: Skip report download (destructive red text, left-aligned) | Back | Remove permanently (disabled)

State 2 — Report Generated (downloading)

Title: "Remove message from channel"

The Section Notice updates to a success variant:

• Icon: Green checkmark

• Title: "Report generated"

• Body: "The report should now be downloading on your device. Once it is downloaded, you can remove the message permanently."

Footer: Skip report download (destructive red text) | Back | Remove permanently (destructive red, enabled)

The button enables immediately upon server-side generation success. Whether the browser completed the save is the reviewer's responsibility.

State 3 — Report Downloaded (ready to delete) (OPTIONAL)

Title: "Remove message from channel"

The Section Notice updates:

• Icon: Green checkmark

• Title: "Report downloaded successfully"

• Body: "The report has been saved to your device. You can now proceed to permanently remove the quarantined message."

Footer: Download again (blue text, replaces "Skip report download") | Back | Remove permanently (enabled)

Implementation note — States 2 and 3: The transition from State 2 to State 3 requires knowing when the file has landed on the reviewer's device. Engineering may collapse these into a single state. The designs show both states for completeness.

State 4 — Error

Title: "Remove message from channel"

A warning Section Notice appears:

• Icon: Warning triangle (yellow/amber)

• Title: "Report could not be generated"

• Body: "We were unable to generate and download the report to your device."

• Action: Try again button inside the notice

Footer: Skip report download (destructive red text) | Back | Remove permanently (disabled)

Clicking "Try again" returns to State 1 (Loading) and re-triggers report generation. There is no max retry limit — the reviewer can also use "Skip report download" or "Back" to exit the loop. "Back" preserves comment and checkbox state in all states including Error.

Download Again Behavior

In State 3, "Download again" triggers a new browser download of the already-generated report without re-generating it. The modal stays in State 3. If the server-side report has expired or is unavailable, the modal transitions to State 4 (Error).

Skip Report Download Confirmation

Clicking "Skip report download" in any state transitions to a confirmation dialog:

• Title: "Remove without report?"

• Body: Context line + "The quarantined message will be permanently deleted without a downloaded report. The message contents will not be recoverable once it is removed. This action cannot be undone."

• Buttons: Cancel | Remove without report (destructive red)

Confirming proceeds with permanent deletion. The skip decision is recorded in the audit trail.

Back and Close Behavior

• Back returns to Step 1, preserving the reviewer's comment and checkbox state.

• Closing the modal (Escape, X button, or click outside) during report generation cancels the generation server-side. The message is NOT removed. The reviewer can restart the flow.

After clicking Remove permanently, the message is deleted from the channel, the quarantine status updates to "Removed", and notifications fire per admin configuration. The modal closes.

4.3 Keep Message + Download (Single-Step)

When the reviewer clicks Keep message, the confirmation modal appears:

• Title: "Keep message"

• Context line: "You are keeping a message by @{Author} posted in ~{Channel}, quarantined for review by @{Reporter}."

• Body: "If you confirm, the message will be visible to all channel members and a notification will be sent to the reporter."

• Add Comment (optional) field

• Checkbox: "Download quarantined message report" — checked by default

• Buttons: Cancel | Keep message (primary blue)

When the checkbox is unchecked, the "Keep message" button remains unchanged (primary blue). Clicking it keeps the message without generating a report.

When the checkbox is checked, clicking Keep message executes the keep action immediately and triggers a background report download — we can keep the 2-step flow as we have in the deletion case but it is not necessary since keeping the message is non-destructive.

If report generation fails in the background, an ephemeral toast notification appears: "Report could not be downloaded. You can download it from the message details." The reviewer can then use the RHS direct download (Flow 4.1) as a fallback.

5. Edge Cases