Apply Redacted Capture Policy Through Narrow Audited Access

Context

Support needs diagnostic conversations, but ordinary usage inspection should not expose customer text.

Decision

Attempt redacted capture for admitted model work under the ninety-day object policy, and return stored evidence only with sensitive permission, an eligible staff grant and successful audit.

Alternatives Considered

Capture failures and explicit diagnostic windows only: Andrew’s recorded capture decision selected always-attempted capture instead.

Capture only while a diagnostic window is open: Unexpected failures outside a window would have no retained conversation.

Store full bodies beside accounting rows: It couples large sensitive content to ordinary query and backup paths.

Consequences

Capture may be pending, skipped or failed, so diagnostic evidence is not guaranteed for every request. The usage API reads bodies without model credentials; runtime functions write them. Reconciliation has neither evidence-read nor model credential authority. Redaction retains ordinary prompt text, requiring narrow access even after secret removal. Current and noncurrent storage lifecycle rules do not prove exact simultaneous expiry.