Preserve diagnostic meaning without collecting everything

What This Concept Is

A telemetry contract specifies allowed fields, value domains, correlation purpose, retention and access. Minimizing collection at the source reduces the burden on later redaction.

Why It Matters Here

Correlation across API and worker is useful, but free-text logs, URLs, headers and baggage can carry credentials or personal data.

Concrete Example

Use a synthetic sentinel secret in a query string, header and exception message. Trace a normal request and a failure through all exporters. Search the actual output for the sentinel while confirming that operation type, status and safe correlation remain. An allowlist that retains a free-text message can still leak the sentinel inside its value.

Common Confusion / Misconception

Hashing a small identifier space does not guarantee anonymity. Removing a field in the collector does not erase earlier application logs, buffers or other exporters. Passing a config check is not evidence that the whole path is clean.

How To Use It

Declare source, processor and sink boundaries. Prefer route templates to raw URLs, bounded classifications to unbounded strings, and explicit access/retention. Test nested attributes and exception events as well as top-level fields.

Check Yourself

Where can data escape before redaction? Which field increases cardinality per user? Can you debug the failure after minimization?

Mini Drill or Application

Inject sentinel values at three entry points and verify both absence of sensitive output and presence of diagnostic evidence. Record any unsupported sink as an unresolved coverage gap.

Read This Only If Stuck

Building Secure and Reliable Systems provides selective operational reasoning. Use the module sources below for current tool behavior; do not read a whole book before attempting the exercise.

OpenTelemetry sensitive data; Collector security; Google SRE monitoring.