---
id: ADR-PFM-LLM-012
title: Apply Redacted Capture Policy Through Narrow Audited Access
product_area: platform
module: llm
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Attempt redacted capture for admitted model work under the ninety-day object policy, and return stored
  evidence only with sensitive permission, an eligible staff grant and successful audit.
constrains:
  - DOM-PFM-LLM-001
  - STATE-PFM-LLM-003
  - WF-PFM-LLM-001
  - WF-PFM-LLM-010
  - WF-PFM-LLM-011
  - SVC-PFM-LLM-llm
  - SCR-PFM-LLM-005
origin: >-
  D-1 (Andrew, 2026-10-18: capture always, as today, overturning the recommendation)
  (services-platform:docs/proposals/llm-observability/11-decisions.md#Decision record).
alternatives:
  - option: Capture failures and explicit diagnostic windows only
    why_not: Andrew’s recorded capture decision selected always-attempted capture instead.
  - option: Capture only while a diagnostic window is open
    why_not: Unexpected failures outside a window would have no retained conversation.
  - option: Store full bodies beside accounting rows
    why_not: It couples large sensitive content to ordinary query and backup paths.
consequences:
  - 'Capture may be pending, skipped or failed, so diagnostic evidence is not guaranteed for every request.'
  - The usage API reads bodies without model credentials; runtime functions write them.
  - Reconciliation has neither evidence-read nor model credential authority.
  - 'Redaction retains ordinary prompt text, requiring narrow access even after secret removal.'
  - Current and noncurrent storage lifecycle rules do not prove exact simultaneous expiry.
supersedes: []
evidence:
  - >-
    services-platform at ad3f6a6: modules/llm/services/evidence/*; aws/resources/llm-evidence.s3.ts;
    aws/logic/llm-runtime.access.ts; services/maintenance/tenant-participant.ts; docs/compliance/exceptions.md
    (EX-AI-002, EX-AI-003).
---

# Apply Redacted Capture Policy Through Narrow Audited Access

## Context

Support needs diagnostic conversations, but ordinary usage inspection should not expose customer text.

## Decision

Attempt redacted capture for admitted model work under the ninety-day object policy, and return stored evidence only with sensitive permission, an eligible staff grant and successful audit.

## Alternatives Considered

Capture failures and explicit diagnostic windows only: Andrew’s recorded capture decision selected always-attempted capture instead.

Capture only while a diagnostic window is open: Unexpected failures outside a window would have no retained conversation.

Store full bodies beside accounting rows: It couples large sensitive content to ordinary query and backup paths.

## Consequences

Capture may be pending, skipped or failed, so diagnostic evidence is not guaranteed for every request. The usage API reads bodies without model credentials; runtime functions write them. Reconciliation has neither evidence-read nor model credential authority. Redaction retains ordinary prompt text, requiring narrow access even after secret removal. Current and noncurrent storage lifecycle rules do not prove exact simultaneous expiry.