Redaction
Field-level masking at the edge — sensitive payloads never leave your network, and replay still works.
Not yet released
Describes intended behavior; the processor ships in Week 8.
Redaction runs in the agent, inside your infrastructure, before telemetry is transmitted. Masked values are never sent, never stored by us, and never present in any backup — because they never arrive.
Redaction preserves structure
This is the part that is easy to get wrong. A redacted field is replaced and named, never deleted:
{
"anthropic.thinking.content": "[REDACTED]",
"southbase.redacted.fields": "anthropic.thinking.content,llm.input_messages",
"southbase.redacted.policy": "default-pii-v1"
}Two reasons this matters more than it looks:
- Deterministic replay needs the shape. To re-run a captured call, the system must know a field existed and what kind of thing it was. Deleting it outright silently breaks replay — and the failure shows up much later, when you are trying to debug something else.
- Auditability. Recording the policy version lets someone answer "why was this masked?" months afterwards, without guessing.
The sentinel [REDACTED] is deliberately distinct from an empty string, so a
redacted field is never confused with a missing or empty one.
How it is tested
The redaction processor's promise is the product's central trust claim, so it is tested adversarially rather than happily: nested payloads, tool arguments, and error messages — not just top-level attributes.
A redaction bypass is treated as a critical security issue, ahead of all
other work. See the agent repository's SECURITY.md.