Add docs for experimental mobile watermarking

[Combs7th]

@claude - You are a senior Mattermost technical writer drafting an admin/end-user documentation update for docs.mattermost.com.

Please review these two linked PRs as the mandatory source of truth:

1. Mobile PR: MM-68274 - Adding watermark capability in mobile mattermost-mobile#9682
2. Server PR: MM-68274 - Adding watermarking toggle in server mattermost#36025

Goal:
Create one combined docs update for the new experimental Enterprise mobile watermarking capability introduced by these PRs.

Important evidence from the PRs to verify:

• Mobile PR adds a visible mobile watermark overlay.
• Server PR adds an experimental Enterprise-gated setting for enabling/disabling mobile watermarking.
• Server PR milestone is v11.7.0.
• The admin setting label appears as “Enable Mobile Watermark:”.
• The setting help text says authenticated mobile sessions display a watermark overlay showing username, domain, date (YYYY-MM-DD), and time (HH:mm) for data loss prevention (DLP) purposes.
• The setting defaults to false.
• The feature is Enterprise-only and experimental.

Docs scope:

• Update product documentation only, not developer docs.
• Do not modify changelogs, upgrade notes, version archive, deprecated/removed features, or unsupported-release pages.
• Avoid implementation details such as code paths, client config generation, prop names, React components, tests, or architecture.
• Focus only on what admins can configure and what mobile users will visibly experience.

Likely docs touchpoints:

1. Experimental configuration settings / System Console documentation:

   • Add the experimental “Enable Mobile Watermark” setting.
   • Include where admins enable it if the PR/docs provide enough evidence.
   • Note that it is disabled by default.
   • Note that it is Enterprise-only.
   • Note that it is experimental.
   • Include “from Mattermost v11.7.0 onward” because the server PR milestone is v11.7.0.

2. Mobile security / DLP documentation:

   • Add a short section explaining that when mobile watermarking is enabled, authenticated mobile sessions display a watermark overlay.
   • Describe what the watermark includes: username, domain, date, and time.
   • Explain the purpose at a high level: data loss prevention / helping identify the source and timing of mobile screenshots or shared screen captures.
   • Do not overstate protection. Do not claim it prevents screenshots, blocks sharing, or guarantees compliance unless explicitly stated in the PR.

Output requirements:

• First, identify the exact docs pages you recommend editing.
• Then provide the proposed RST/Markdown copy for each page.
• Include a concise before/after summary.
• Include any open questions for Asaad only where the answer is not present in the PR.
• Mark anything not directly supported by PR evidence as: [NOT PRESENT IN PR — REQUIRES HUMAN JUDGMENT].

Please keep the update minimal and focused. This should be one docs PR covering the combined admin toggle + mobile user-visible behavior.

[claude]

Claude finished @Combs7th's task in 4m 11s —— View job • claude/issue-8953-20260512-0010 • Create PR ➔

---

Mobile watermarking docs update — proposed changes pushed

• Read PR-evidence summary from the issue body (I do not have network access to fetch the PRs directly; trusting the verified evidence you provided and flagging anything beyond it).
• Explore repo structure for relevant docs pages
• Identify exact pages to edit
• Edit source/administration-guide/configure/experimental-configuration-settings.rst (admin toggle)
• Edit source/deployment-guide/mobile/mobile-security-features.rst (deep-dive)
• Edit source/security-guide/mobile-security.rst (short overview)
• Commit and push to claude/issue-8953-20260512-0010

---

Pages recommended to edit (and why)

1. source/administration-guide/configure/experimental-configuration-settings.rst — the canonical home for System Console Experimental > Features settings. The new toggle was inserted alphabetically between Enable hardened mode and Enable theme selection.
2. source/deployment-guide/mobile/mobile-security-features.rst — the technical deep-dive on mobile security controls (DLP, screen capture prevention, secure file preview, etc.). Adds a new Mobile watermarking section between Secure file previews and Microsoft Intune MAM.
3. source/security-guide/mobile-security.rst — the higher-level Security Guide overview of mobile security. Adds a short Mobile watermarking section between Secure file preview and Burn-on-read messages, pointing readers to (2) and (1).

Before / After summary

Page	Before	After
experimental-configuration-settings.rst	No mention of mobile watermarking.	New config:setting:: entry Enable Mobile Watermark (Experimental, Enterprise, default false, v11.7+) with a note that the overlay is visual only and not a substitute for screen-capture prevention.
deployment-guide/mobile/mobile-security-features.rst	No mention of mobile watermarking.	New Mobile watermarking section explaining the overlay (username, domain, YYYY-MM-DD, HH:mm), DLP-attribution intent, scope (mobile app only), and limitations (does not block screenshots). Cross-links to the experimental config setting.
security-guide/mobile-security.rst	No mention of mobile watermarking.	Short overview paragraph mirroring the pattern used for Secure file preview / Disable downloads / Burn-on-read, with cross-links into the deep-dive and the experimental config setting.

Items flagged for human verification ([NOT PRESENT IN PR — REQUIRES HUMAN JUDGMENT])

• config.json key path — I used ExperimentalSettings.EnableMobileWatermark because it matches the System Console "Experimental > Features" location and the literal UI label. The exact key was not stated in the issue body evidence and I could not fetch the server PR directly to confirm. Please verify and correct the JSON path (and the :configjson: and config.json callout box) before merging. If the key actually lives under e.g. ServiceSettings or uses a different name like ExperimentalEnableMobileWatermark, update both occurrences in experimental-configuration-settings.rst.
• Environment variable — I left this as N/A, consistent with the surrounding experimental entries that don't expose env vars. If the server PR registers one (e.g. MM_EXPERIMENTALSETTINGS_ENABLEMOBILEWATERMARK), please add it.
• Enterprise plan tier exact wording — I used "Available on Enterprise and Enterprise Advanced plans" (matches the existing ent-plus.rst badge wording) because the issue body says "Enterprise-only". If the server PR restricts to Enterprise Advanced only, switch to the ent-adv.rst wording instead.
• Watermark visual presentation — opacity, repetition pattern, font, position on screen, etc. are not in the evidence summary, so I deliberately did not describe them. If the mobile PR is final and you want a screenshot or a one-line description of the layout, that can be added.
• Does the watermark also appear during share-sheet exports / file previews / video playback? Not stated. Left out.
• Does enabling the setting require an app restart / log-out / sign back in? Other mobile-affecting settings on the same page include a .. note:: to that effect; I did not add one for the watermark since I have no PR evidence either way. Worth confirming with Asaad.

Open questions for Asaad

1. What is the canonical config.json JSON path for the new toggle? (See above — best guess used as a placeholder.)
2. Is there an environment variable binding, or is this config.json/System Console only?
3. Is the SKU gate Enterprise + Enterprise Advanced, or Enterprise Advanced only?
4. Does the watermark apply only while a user is in an authenticated session, or also on pre-login screens (server selection, login form)? The PR help text says "authenticated mobile sessions" — assumed authenticated-only and worded accordingly.
5. Does enabling/disabling the toggle take effect immediately, or only after the mobile user restarts the app / signs out and back in? (Adding a .. note:: if so.)
6. Should the mobile app changelog (source/product-overview/mobile-app-changelog.md) get a one-liner for v11.7, or is that handled by a separate release-notes workflow? The issue scope says "Do not modify changelogs," so I left it alone — flagging in case that exclusion was meant for the server changelog only.
   · Branch: claude/issue-8953-20260512-0010