PRE-prompt redaction

Motivation

A prompt is an exfiltration channel. The moment you interpolate “context” into a model call, you risk shipping
a Bearer token, a private key, a customer email, or an internal IP to a provider whose logs you don’t control.
The fix cannot be “remember to sanitize” — it has to be a mandatory stage that runs before the prompt
is ever assembled, and again on the output as defense-in-depth.

Padosoft\Iam\Ai\Governance\Redactor is that stage: deterministic, regex-based, fail-safe, and on the
critical path of every AI call.

Theory: redact-before-transmit, and redact-again

Let $u$ be the user prompt and $E$ the evidence. The AdvisoryClient never transmits $u$ or $E$ — it
transmits $\rho(u)$ and $\rho(E)$, where $\rho$ is the redaction function. After the model returns $o$, it
returns and audits $\rho(o)$, not $o$:

The fail-safe principle makes $\rho$ a conservative over-approximation: when a token might be a secret,
it is redacted. The cost of a false positive is a slightly less rich prompt; the cost of a false negative is a
leak. The asymmetry dictates the bias.

Model: what gets redacted

The Redactor applies an ordered list of patterns, each replacing a match with a typed placeholder:

Two design details that matter:

• Keyed secrets are stripped to end-of-line. A secret value with spaces (secret = a long pass phrase)
  would otherwise leak its tail; matching to \n removes the whole value while preserving following lines.
• Hex is matched before base64. A 64-character hex string is also valid base64; redacting hex first
  yields the more specific [REDACTED_HEX] placeholder instead of fragmenting it.

redactArray() walks evidence structures recursively, redacting string values while preserving keys
(keys are field names, not secrets) and leaving non-strings untouched.

The didRedact signal

The Redactor exposes a public bool $didRedact set to true whenever any pattern fired. The
AdvisoryClient resets it per call (the redactor instance can be shared/singleton), runs redaction, and
records the flag on the Advisory as redacted. That flag flows into the audit trail so you can answer “was
anything stripped from this interaction?” without ever storing the secret itself.

$r = new Redactor;
$out = $r->redact('Authorization: Bearer abc.def.ghi and password=Sup3rSecret for mario@acme.it from 10.0.0.5');
// $out contains no 'Bearer abc', 'Sup3rSecret', 'mario@acme.it', or '10.0.0.5'
$r->didRedact; // true

$clean = (new Redactor)->redact('Mario has the role warehouse:stock_operator.');
// unchanged; didRedact === false

ADR

Worked example: redaction inside the pipeline

config(['iam-ai.enabled' => true]);

$advisory = $client->advise(
    task: 'explain',
    system: 'You are a security assistant.',
    userPrompt: 'token=Bearer abc.def.ghi — why was this denied?',
    evidence: ['note' => 'user mario@acme.it from 10.0.0.5'],
    allowedRefs: [],
    deterministicFallback: 'Access denied.'
);

// The provider received a prompt with no 'abc.def.ghi', no email, no IP.
$advisory->redacted; // true

Gotchas

See also

• Tuning redaction
• The advisory pipeline
• Audit & privacy