Privacy-aware observability

Observe system behavior without turning every prompt and document into permanent telemetry.

DIRECT ANSWER

Collect the minimum fields needed to answer an operating question. Prefer identifiers, categories, timings, counts, versions, and redacted samples over full sensitive payloads, then apply access and deletion rules to traces.

SYSTEM FLOW

Make every boundary visible.

01event
02classify
03redact
04sample
05store
06alert
07delete

DESIGN DECISIONS

Three decisions carry the architecture.

Start from decisions

Name the alert, investigation, evaluation, or cost question before adding a telemetry field.

Redact at collection

Remove secrets and prohibited data before the event crosses into logs, traces, analytics, or support tools.

Separate access

Restrict raw diagnostic records more tightly than aggregate operational metrics.

FAILURE MODES

What breaks the boundary.

Debug logging captures full user content
A trace vendor becomes an undocumented processor
Deletion removes the source record but not diagnostic copies

VERIFICATION

Evidence before release.

Secret-seeding test
Trace access review
Retention expiry test
Deletion search