Runs on every payload in AuditTrail.Buffer right before it ships — the one choke point every entry point (emit/2, monitor/4, schema-level Diff, ControllerAudit) funnels through. Besides making values JSON-safe, it redacts any map value whose key matches AuditTrail.Config.sensitive_fields/0 (case-insensitively, atom or string keys, at any nesting depth) — so a sensitive field slipping into a track: :all schema diff, or into monitor/emit's original_record:/ params: diffing, still gets caught here even if the call site forgot to filter it out itself. ControllerAudit still does its own upfront Map.drop/2 for the same field list — this is the backstop for everything else.