Skip to main content

Secure-by-default redaction

Built-in and configurable patterns scrub recognized secrets before transport.

Task args, kwargs, return values, and exceptions pass through a rule-based redaction engine before leaving the agent process. Built-in patterns cover common credential and PII shapes; add operator patterns and per-task overrides for application-specific data. Defense-in-depth: z4j re-scrubs on ingest.

Preview
z4j dashboard - Secure-by-default redaction
Redaction at capture RAW (never leaves agent) task = charge_customer( customer_id="cus_abc123", amount=2495, api_key="sk_live_51H...", authorization="Bearer eyJhbG...", card="4242 4242 4242 4242", user_email="[email protected]", ssn="123-45-6789" ) REDACTED (what brain sees) task = charge_customer( customer_id="cus_abc123", amount=2495, api_key="<redacted:api_key>", authorization="<redacted:header>", card="<redacted:card>", user_email="<redacted:email>", ssn="<redacted:ssn>" ) # Pattern matches applied: # ✓ Stripe key format # ✓ Bearer token header # ✓ Credit card (Luhn) # ✓ Email / SSN / custom

Mockup of the dashboard view for this feature. Live-reloading and themed to match your dashboard.

Ships with

  • Recursive scrubber for nested dicts / lists / custom classes
  • Pattern matching: API keys, tokens, AWS creds, private keys, ~40 common patterns
  • Per-task overrides via @z4j_meta(redact_kwargs=[...])
  • Brain-side re-scrub (defense in depth, does not trust agent)
Related

More capabilities

Automation rule engine

Match a trigger. Run a governed action. Every firing on the audit chain.

Learn more

Issues: failure fingerprinting

The same bug across every run collapses into one issue.

Learn more

Durable bulk retry

Retry a thousand failures once, and only once.

Learn more

Ready to try z4j?

Install z4j How z4j works