[0.2.0][M5] Audit redaction: prevent PII/secrets leaking into the audit log from audit-mode calls #158

Summary of Issue

When the engine returns an audit (allow-but-log-heavily) decision, tool-call arguments are written to the audit log as-is. If an agent reads PII or secrets while in audit mode, those values land verbatim in the audit store — turning the audit log itself into a secondary breach vector.

WHAT

Today the gatekeeper validates the call and logs the decision, but it does not redact sensitive argument values before persisting them. A read_file(path=<secret-file>) in audit state stores the secret-bearing path (or content) into the audit log, which now holds the same secret the policy was meant to protect, in a second location with its own access controls.

WHY we should address

An audit log that contains raw secrets is not trustworthy: it becomes a higher-value target than the primary system it is meant to monitor, and it can leak PII into compliance-sensitive sinks (SIEM, backups, third-party stores). A gatekeeper that protects tools while silently persisting their secrets is failing its own core promise. Redaction is a prerequisite for the audit log being both useful and safe.

How to address

• Add redaction at the sink level, so raw values never leave the process.
• Add a default deny-list of obvious secret keys (token, password, apiKey, authorization, secret, body for sensitive tools) plus a per-policy override (args.redact: [...]).
• Replace matched values with a placeholder (e.g. ***REDACTED:<field>***) and set an explicit redacted: true flag on the audit entry.
• Apply redaction to all decision outcomes (allow + audit + allow_with_obligation), not only audit mode.
• Cover nested structures (dicts, lists) so a secret nested inside an argument object is also caught.

Acceptance criteria

• Secret/PII values never appear in the persisted audit log for any decision outcome
• args.redact per-policy override works alongside the default deny-list
• tests/test_audit_redaction.py verifies redaction across allow/audit/obligation outcomes and nested args
• redacted: true flag present on redacted entries
• Ruff + mypy strict clean; docstrings on new .py files

Source

dev.to comment: https://dev.to/debashish_ghosal/comment/3d29a