Redaction is defense in depth
Pattern matching cannot reliably sanitize arbitrary secrets or production content. Collection must avoid emitting sensitive data in the first place. Authentication and explicit public schemas remain the primary boundaries; redaction reduces incidental exposure inside the owner view.
Cardinality and payload rules
Run IDs and trace IDs belong in bounded diagnostic records, not unconstrained metric labels. Production article text, prompts, model outputs, and tokens must not be copied into new telemetry. This matters both for privacy and for avoiding runaway series counts.
Trace rollout
If trace export is added, propagate context through the actual request and queue boundaries and verify a complete sample. Respect the existing sampling ceiling, retention, and quota controls. Do not present a synthetic trace or disconnected spans as proof of production end-to-end coverage.