Redaction

Redaction rewrites outbound text right before it is sent to the LLM provider. It runs on user input and tool results. Assistant output and the system prompt are left untouched: the model has already seen its own prior responses, and the system prompt is authored by you.

The original messages remain in the session's stored history. Each turn re runs the redactor on the messages that are about to be sent, so secrets never leave the BEAM process.

Default redactor#

Condukt.Redactors.Regex covers common high precision patterns:

Emails
JWTs
PEM private keys
Anthropic, OpenAI, GitHub, Google, AWS, Slack tokens

Matches are replaced with [REDACTED:KIND] placeholders that the LLM can still reason about ("an email was here") without learning the value.

elixir

{:ok, agent} =
  MyApp.CodingAgent.start_link(redactor: Condukt.Redactors.Regex)

Adding patterns#

Pass :extra_patterns to extend the defaults:

elixir

{:ok, agent} =
  MyApp.CodingAgent.start_link(
    redactor:
      {Condukt.Redactors.Regex,
       extra_patterns: [{~r/cust_[a-z0-9]+/, "CUSTOMER"}]}
  )

Each entry is {regex, label}. Matches are replaced with [REDACTED:LABEL].

Custom redactors#

Implement Condukt.Redactor to plug in anything you want, including NER based PII detection or a call to an internal service:

elixir

defmodule MyApp.Redactor do
  @behaviour Condukt.Redactor

  @impl true
  def redact(text, _opts) do
    MyApp.PiiScanner.scrub(text)
  end
end

MyApp.CodingAgent.start_link(redactor: MyApp.Redactor)

redact/2 receives the raw outbound text and the keyword options that were passed alongside the module in a {module, opts} tuple (or [] if none).

Tool result redaction#

Tool results that are not strings (maps, lists) are JSON encoded before the redactor runs, so secrets embedded in structured output are still caught. The result the model sees is the redacted JSON.

Session secrets#

Session secrets configured through :secrets are converted into a Condukt.Redactors.Secrets redactor and composed ahead of the configured :redactor. This keeps resolved provider secrets in the same outbound redaction pipeline as regex or custom redactors.

Unlike general outbound redactors, session secret values are also exact-match redacted from tool results before they are stored in session history. This prevents resolved session credentials from being persisted if a command prints them.

What is not redacted#

The system prompt
Assistant output
Project instructions (AGENTS.md, CLAUDE.md, skills)

Treat the system prompt and project instructions as developer authored content. If you need redaction there, scrub them before passing them in.