Protect the trail and its subjects

Audit records can contain private object references, task text, error details and action payloads. Access to the trail should be scoped by role and purpose, with more restrictive handling for full content than for operational metadata.

Use structured redaction at event creation. Tool schemas can mark credential, personal and high-sensitivity fields so the gateway omits or tokenises them before logging. A general regular expression applied later can miss context-specific secrets or remove information needed for recovery.

Do not log raw access tokens, session cookies, secret headers or full connection strings. Store a secret reference or credential identity. If a tool accidentally returns a credential, the event pipeline should quarantine the payload and alert the responsible operator rather than spread it to search indexes.

Protect integrity with append-only storage controls and restricted writer identities. Corrections should create new events that reference the incorrect event. If the store cannot enforce immutability, database permissions, versioned rows and independent backups can still make silent alteration harder.

Retention should vary by event content and obligation. Task metadata may need a different period from copied prompt text or source snippets. Record deletion and legal-hold actions as administrative events, while ensuring privacy-driven deletion reaches indexes, caches and exported copies where required.

Separate operational search from bulk export. A reviewer who can inspect one authorised task does not automatically need a downloadable dataset of all tasks. Monitor unusual audit access because the log itself maps sensitive activity.

Test redaction with actual tool payload shapes and failure messages. Error objects often contain request bodies, file paths or provider headers that the success path never exposes.