(DOCSP-24983) QE Server Side Schema Behavior (#2018)

* wip

* Trigger Build

* proofread, spell-check, grammar-check

* js - suggestion

Co-authored-by: Jordan Smith <[email protected]>

Co-authored-by: Jordan Smith <[email protected]>

Author: biniona-mongodb

source/core/queryable-encryption.txt

@@ -34,6 +34,8 @@ scheme developed by the pioneers in encrypted search. The feature supports equal
 searches, with additional query types such as range, prefix, suffix, and substring 
 planned for future releases.
 
+.. _manual-qe-mechanisms:
+
 You can set up {+qe+} using the following mechanisms:
 
 - Automatic Encryption: Enables you to perform encrypted read and

source/core/queryable-encryption/fundamentals/encrypt-and-query.txt

@@ -126,6 +126,47 @@ Note that the ``keyId`` field requires a unique {+dek-long+} (DEK) which {+qe+}
 uses to encrypt the fields. For more information on DEKs, see
 :ref:`qe-fundamentals-manage-keys`.
 
+Client and Server Schemas
+~~~~~~~~~~~~~~~~~~~~~~~~~
+
+.. content copied from source/core/csfle/fundamentals/automatic-encryption.txt
+
+MongoDB supports using
+:ref:`schema validation <schema-validation-overview>`
+to enforce encryption of specific fields
+in a collection. Clients performing automatic {+qe+} have
+specific behavior depending on the database connection
+configuration:
+
+- If the connection 
+  ``encryptedFieldsMap`` object contains a key for the specified collection, the 
+  client uses that object to perform automatic {+qe+}, 
+  rather than using the remote schema. At a minimum, the local rules **must** 
+  encrypt those fields that the remote schema marks as requiring 
+  encryption.
+
+- If the connection
+  ``encryptedFieldsMap`` object does *not* contain a key for the specified 
+  collection, the client downloads the server-side remote schema for 
+  the collection and uses it to perform automatic {+qe+}.
+
+  .. important:: Behavior Considerations
+
+     When a client does not have an encryption schema for the
+     specified collection, the following occurs:
+
+     - The client trusts that the server has a valid schema with respect
+       to automatic {+qe+}.
+     
+     - The client uses the remote schema to perform automatic
+       {+qe+} only. The client does not enforce any other
+       validation rules specified in the schema.
+
+To learn more about automatic {+qe+}, see the following resources:
+
+- :ref:`{+qe+} Introduction <manual-qe-mechanisms>`
+- :ref:`<qe-quick-start>`
+
 Specify Queryable Encrypted Fields
 ----------------------------------