Repository navigation
fix: redact end-user identifiers, locations and credentials in extproc debug logs - #2981
Open
hustxiayang wants to merge 5 commits into
Open
hustxiayang wants to merge 5 commits into
hustxiayang wants to merge 5 commits into
Conversation
✅ Deploy Preview for theagentrouter canceled.
|
Codecov Report❌ Patch coverage is
📢 Thoughts on this report? Let us know! |
Contributor
|
/retest |
Signed-off-by: yxia216 <yxia216@bloomberg.net>
Signed-off-by: yxia216 <yxia216@bloomberg.net>
Signed-off-by: yxia216 <yxia216@bloomberg.net>
hustxiayang
force-pushed
the
redact-end-user-identifiers
branch
from
November 5, 2026 14:51
786a9e8 to
f078ea0
Compare
aabchoo
approved these changes
Nov 5, 2026
aabchoo
left a comment
aabchoo
left a comment
Contributor
There was a problem hiding this comment.
Overall looks good to me!
| - **Redacted: end-user identifiers and free-form caller annotations**, such as `user`, `safety_identifier` and `metadata` values. These are usually set by the application rather than typed by the end user, but their values identify a person, and the gateway cannot tell whether the application hashed them. | ||
| - **Kept: model and format configuration**, such as the model name, sampling parameters, tool definitions and response format schemas. These describe how to call the model rather than who is calling or what they said, and keeping them makes the logs useful for debugging. | ||
|
|
||
| Response bodies are redacted as a whole. |
Contributor
There was a problem hiding this comment.
Update to be:
The external processor logs the response body as a single placeholder. Translators additionally log the parsed response with message content, reasoning, tool arguments and audio redacted; metadata such as the response id, model, usage and tool names is kept.
| redactInPlace(&location.City, &location.Region, &location.Country, &location.Timezone) | ||
| return openai.ResponseToolUnion{OfWebSearchPreview: &webSearch} | ||
| case tool.OfUnknown != nil: | ||
| return openai.ResponseToolUnion{OfUnknown: redactRawJSON(tool.OfUnknown)} |
Contributor
There was a problem hiding this comment.
Should we try to parse the type if possible? Otherwise we get no info
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
With redaction enabled, the extproc debug log still carried end-user identifiers (
user,safety_identifier,metadata, location, …), content that restates the prompt, and MCP credentials, because each endpoint redacts only the fields it names. This PR redacts them in the request redactors. In the translator response logs, it redactsthinking_blocks(OpenAI, Bedrock, Vertex AI and GCP Anthropic translators) and the reasoningsignatureandredactedContent, where only the reasoning text was redacted before. #2980 lists every field and why it must be redacted.It also adds
site/docs/capabilities/observability/debug-log-redaction.md, so operators can see whatenableRedactioncovers, what it keeps, the placeholder format, and how it differs fromOPENINFERENCE_HIDE_*trace hiding.Related Issues/PRs (if applicable)
Fixes #2980
Special notes for reviewers (if applicable)
mcp_serverskeeps a list of safe keys instead of a list of secret keys. Our schema does not model MCP server entries (type MCPServer any), so each entry is whatever map the caller sent. The redactor keeps onlytype,nameandtool_configurationand redacts every other key. If Anthropic adds a new credential field, it is redacted without a code change, whereas a list of keys to redact would log it until someone updated the list. This is the only keep-list in the change, so it should not be converted to match the others.