The leak it prevents
Agents are great at quietly widening blast radius. A tool result comes back with an authorization header or a customer email. The agent stuffs the whole blob into its next prompt "for context," and now your PII is in a third-party model's logs, or worse, in a corpus you later fine-tune on. The fix isn't "remember to scrub." It's a floor: a single chokepoint every outbound payload passes through. It strips the deny-list before the call, every time, no per-call judgment required.
Redaction happens at write/send time. Scrub at read time and there's still a window where raw data sits somewhere it shouldn't. Scrub before the value is ever persisted or transmitted, and the artifact is safe by construction.
The skill
# redaction-floor
# Enforce a PII/secret redaction floor before any LLM call,
# outbound API request, or write to disk.
## Use when
- An agent will send tool output, retrieved data, or memory into a prompt.
- A payload leaves the trust boundary: external API, log line, persisted file.
- You are building a corpus you might later train or fine-tune on.
## Never skip when
- "It's just for debugging": debug logs are the most common leak.
- The data "looks clean": verify against the deny-list, don't eyeball it.
## Deny-list (redact to [REDACTED])
- Auth: authorization, cookie, set-cookie, any *-token / *-key / *-secret header
- Identity: email, phone, full name, government IDs, DOB
- Financial: PAN / card numbers, IBAN, account numbers
- Free-text: scan bodies, not just headers; PII hides in messages
## Procedure
1. Build the outbound payload.
2. Pass it through ONE redact function at the boundary, never inline,
never optional. The floor is the only path out.
3. Redact by KEY (deny-list) AND by VALUE (regex for emails, cards, tokens).
4. Default to redaction on uncertainty. A false-positive redact is cheap;
a leak is not.
5. Keep an opt-in, scoped "verbatim" mode for the rare case you truly need
raw data: explicit, logged, and never the default.
## Litmus
If a new code path can reach the LLM / network / disk WITHOUT crossing the
floor, the floor doesn't exist yet. Make the boundary the only door.Why a floor beats a filter
A filter is something you remember to apply. A floor is something a payload cannot get around. The whole value is in making the safe path the only path: one function at one boundary that everything funnels through. The day someone adds a new tool or a new log line, they get redaction for free instead of opening a hole nobody notices for six months.
Don't trust callers to scrub.