---
id: CAP-PFM-LLM-004
title: Retain redacted AI evidence and remove it safely
feature: FEAT-PFM-LLM-01
product_area: platform
module: llm
revision: 1
status: draft
product_intent: proposed
implementation_evidence: observed
supersedes: []
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
intent_sources:
  - 'services-platform:docs/proposals/llm-observability/11-decisions.md#D-1'
  - 'services-platform:docs/milestones/PLAT-M1-ai-usage-metered-and-visible.md#D-1 (proposal)'
purpose: Preserve diagnostic content under a bounded retention policy while keeping it out of ordinary usage reports.
outcomes:
  - 'Capture records distinguish saved, skipped and failed content.'
  - Redaction removes recognized credentials while retaining useful diagnostic text.
  - Organization deletion purges its AI records and saved evidence.
concepts:
  - CON-PFM-LLM-001
actors:
  - ACT-PFM-012
  - ACT-PFM-004
surfaces:
  - job
preconditions: []
postconditions:
  - Request and response capture each have a recorded status.
permissions: []
rules:
  - id: BR-CAP-PFM-LLM-004-01
    proved_by: [ATS-PFM-LLM-001-13, ATS-PFM-LLM-004-01, ATS-PFM-LLM-004-06, TST-PFM-LLM-020]
    statement: >-
      The runtime attempts redacted request capture before dispatch and response capture after a loop result
      under a ninety-day retention policy; allowance refusals have no bodies and capture may be skipped or
      fail.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/llm/services/execution/run-operation.ts:recordCapture'
    origin: 'services-platform:docs/proposals/llm-observability/11-decisions.md#D-1'
  - id: BR-CAP-PFM-LLM-004-02
    proved_by: [ATS-PFM-LLM-004-02, TST-PFM-LLM-020, TST-PFM-LLM-072]
    statement: >-
      Redaction replaces secret-named field values and recognizable credentials wherever they appear while
      retaining ordinary prompt text.
    kind: policy
    enforced_at:
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/llm/services/evidence/evidence-redaction.ts'
    origin: none
  - id: BR-CAP-PFM-LLM-004-03
    proved_by: [ATS-PFM-LLM-004-03, TST-PFM-LLM-034]
    statement: >-
      Evidence bodies are stored separately from request and attempt records, whose contents consist of
      references, counts and operational details.
    kind: invariant
    enforced_at:
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/llm/services/persistence/invocations.ts:recordInvocationAttempt'
    origin: none
  - id: BR-CAP-PFM-LLM-004-04
    proved_by: [ATS-PFM-LLM-004-07, TST-PFM-LLM-014]
    statement: >-
      Capture status distinguishes pending, captured, skipped, failed and purged, and database constraints
      require a storage reference for a captured body.
    kind: invariant
    enforced_at:
      - database
    must_prove: false
    provenance: observed
    source: 'services-platform:modules/llm/db/llm-invocations.table.ts:LLM_PAYLOAD_CAPTURE_STATUSES'
    origin: none
  - id: BR-CAP-PFM-LLM-004-05
    proved_by: [ATS-PFM-LLM-004-04, TST-PFM-LLM-027]
    statement: >-
      Organization deletion removes its AI records in dependency order and all versions of its evidence
      without changing neighboring organizations’ data.
    kind: lifecycle
    enforced_at:
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/llm/services/maintenance/tenant-participant.ts'
    origin: none
  - id: BR-CAP-PFM-LLM-004-06
    proved_by: [ATS-PFM-LLM-004-04, TST-PFM-LLM-027]
    statement: >-
      Deletion removes evidence after the last dependent AI record, preserving references until those records
      are gone.
    kind: invariant
    enforced_at:
      - service
    must_prove: true
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#removes
      the evidence only after the last row, so a surviving row never names a deleted body
    origin: none
  - id: BR-CAP-PFM-LLM-004-07
    proved_by: []
    statement: >-
      AI provision creates no allowance or request records for a new organization; the first request creates
      them when needed.
    kind: lifecycle
    enforced_at:
      - service
    must_prove: false
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#provisions
      nothing, because a tenant’s allowance is created by its first call
    origin: none
  - id: BR-CAP-PFM-LLM-004-08
    proved_by: []
    statement: >-
      Runtime functions may write evidence and use model credentials, the HQ content-reading function may read
      evidence without model credentials, and reconciliation holds neither authority.
    kind: invariant
    enforced_at:
      - service
    must_prove: false
    provenance: documented
    source: 'services-platform:docs/llm.md#Reading a body, and what deletes it'
    origin: none
  - id: BR-CAP-PFM-LLM-004-09
    proved_by: [ATS-PFM-LLM-004-05]
    statement: >-
      Capture returns skipped when no evidence store is configured and failed when redaction, serialization or
      writing fails, allowing request processing to continue. A memory evidence store cannot be constructed in
      deployed configuration.
    kind: validation
    enforced_at:
      - service
    must_prove: true
    provenance: observed
    source: 'services-platform:modules/llm/services/evidence/evidence-store.ts'
    origin: none
scenarios:
  - id: SC-CAP-PFM-LLM-004-01
    given: A prompt contains a recognized credential.
    when: The redactor processes captured content.
    then: The credential is replaced while surrounding prompt text remains.
    provenance: test
    source: >-
      services-platform:modules/llm/tests/unit/services/evidence-redaction.spec.ts#keeps the prompt’s own
      words
  - id: SC-CAP-PFM-LLM-004-02
    given: An organization has stored AI history.
    when: Its deletion participant runs.
    then: Its records and evidence are removed without purging a similarly named organization.
    provenance: test
    source: >-
      services-platform:modules/llm/tests/integration/services/maintenance/tenant-participant.integration.spec.js#leaves
      the evidence of another tenant, and of one whose id begins like the purged one, exactly as it was
edge_cases: []
constraints:
  - The provider’s own content-retention policy remains unestablished.
depends_on:
  - CAP-PFM-LLM-001
related:
  - CAP-PFM-LLM-016
journeys: []
open_questions: []
evidence:
  - >-
    services-platform at ad3f6a6582843008ed0f5a17b131878d15829af1: docs/llm.md (Evidence, Reading a body, What
    the logs say a call cost); docs/compliance/exceptions.md (EX-AI-003);
    modules/llm/services/evidence/evidence-redaction.ts, evidence-store.ts, tenant-evidence-objects.ts;
    services/maintenance/tenant-participant.ts; aws/resources/llm-evidence.s3.ts; tests
    unit/services/evidence-redaction.spec.ts,
    integration/services/maintenance/tenant-participant.integration.spec.js,
    integration/services/persistence/invocations.integration.spec.js.
controls: [TC-AI-006, TC-AI-007, TC-AZ-001, TC-AZ-002, TC-AZ-003, TC-AZ-004, TC-AZ-005, TC-CHG-001, TC-CHG-002, TC-CHG-003, TC-CHG-004, TC-CHG-005, TC-CHG-006, TC-CRY-001, TC-CRY-002, TC-CRY-003, TC-CRY-004, TC-DAT-001, TC-DAT-002, TC-DAT-003, TC-DAT-004, TC-IAM-001, TC-IAM-002, TC-IAM-003, TC-IAM-004, TC-IAM-005, TC-LOG-001, TC-LOG-002, TC-LOG-003, TC-LOG-004, TC-LOG-005, TC-MON-001, TC-PI-001, TC-PI-003, TC-PI-005, TC-PRV-001, TC-PRV-002, TC-SEC-001, TC-SEC-002, TC-SEC-003, TC-SEC-004, TC-TEN-001, TC-TEN-002, TC-TEN-003, TC-VEN-001, TC-VEN-002, TC-VEN-003]
exercised_by: [FAS-PFM-LLM-01-01, FAS-PFM-LLM-01-03, FAS-PFM-LLM-01-04]
suites: [TST-PFM-LLM-014, TST-PFM-LLM-020, TST-PFM-LLM-027, TST-PFM-LLM-034, TST-PFM-LLM-072]
---

# Retain redacted AI evidence and remove it safely

## Purpose

Preserve diagnostic content under a bounded retention policy while keeping it out of ordinary usage reports.

## How It Works

Platform attempts to capture the request before model dispatch and the response after the conversation returns. It redacts recognizable secret fields and credential-shaped text before storage. The usage record keeps capture status and an evidence reference rather than the body. Failed or unconfigured capture does not establish that evidence exists. Rhythm staff use a separate controlled read to inspect retained content. The evidence bucket applies the retention policy. Organization deletion removes the usage data and then its stored evidence versions. The product should resolve the provider compliance questions that accompany routine content capture.

## Relationships

- Run AI requests with consistent attribution and accounting supplies the prerequisite behavior for this outcome.