# Redaction

Redaction rewrites outbound text right before it is sent to the LLM
provider. It runs on user input and tool results. Assistant output and the
system prompt are left untouched: the model has already seen its own prior
responses, and the system prompt is authored by you.

The original messages remain in the session's stored history. Each turn re
runs the redactor on the messages that are about to be sent, so secrets
never leave the BEAM process.

## Default redactor

`Condukt.Redactors.Regex` covers common high precision patterns:

* Emails
* JWTs
* PEM private keys
* Anthropic, OpenAI, GitHub, Google, AWS, Slack tokens

Matches are replaced with `[REDACTED:KIND]` placeholders that the LLM can
still reason about ("an email was here") without learning the value.

```elixir
{:ok, agent} =
  MyApp.CodingAgent.start_link(redactor: Condukt.Redactors.Regex)
```

## Adding patterns

Pass `:extra_patterns` to extend the defaults:

```elixir
{:ok, agent} =
  MyApp.CodingAgent.start_link(
    redactor:
      {Condukt.Redactors.Regex,
       extra_patterns: [{~r/cust_[a-z0-9]+/, "CUSTOMER"}]}
  )
```

Each entry is `{regex, label}`. Matches are replaced with `[REDACTED:LABEL]`.

## Custom redactors

Implement `Condukt.Redactor` to plug in anything you want, including NER
based PII detection or a call to an internal service:

```elixir
defmodule MyApp.Redactor do
  @behaviour Condukt.Redactor

  @impl true
  def redact(text, _opts) do
    MyApp.PiiScanner.scrub(text)
  end
end

MyApp.CodingAgent.start_link(redactor: MyApp.Redactor)
```

`redact/2` receives the raw outbound text and the keyword options that were
passed alongside the module in a `{module, opts}` tuple (or `[]` if none).

## Tool result redaction

Tool results that are not strings (maps, lists) are JSON encoded before the
redactor runs, so secrets embedded in structured output are still caught.
The result the model sees is the redacted JSON.

## What is not redacted

* The system prompt
* Assistant output
* Project instructions (`AGENTS.md`, `CLAUDE.md`, skills)

Treat the system prompt and project instructions as developer authored
content. If you need redaction there, scrub them before passing them in.