Privacy and security

The default policy is metadata-only. Raw prompts, responses, contexts, tool arguments and results, retrieved documents, media, and future judge evidence are excluded. ExecutionObservation represents such material with bounded ContentReference hashes and metadata.

Content export requires both capture_content = true and an exact content_allowlist. Allowed string values are still redacted for recognized secrets and truncated to the configured byte limit before local export. This is an explicit diagnostic capability, not consent or a complete data-loss prevention system.

  • Keep credentials in the environment variable named by headers_env.

  • Use TLS to the Collector outside a trusted local network.

  • Restrict backend, SQLite, and evaluation-store access.

  • Align local max_age_days and max_traces with the data policy.

  • Test content capture disabled and scan examples and fixtures for credentials.

Metric and log dimensions use bounded names and structured error types; secret looking dimension values are redacted. Exporter exceptions are reported by type rather than by potentially sensitive message.

Content enablement checklist

Before setting capture_content=true:

  1. Name the diagnostic purpose and the exact allowlisted content kinds.

  2. Redact secrets and regulated identifiers before they reach Praval; built-in patterns are a safety net, not a complete DLP policy.

  3. Set retention by both age and trace count, and test whole-trace deletion.

  4. Restrict filesystem/database and backend access, backups, and exports.

  5. Confirm cross-region transfer, incident response, and user deletion rules.

  6. Run privacy tests with representative prompts, tool payloads, retrieved material, media metadata, credentials, and exporter failures.

Content allowlisting never makes a value suitable as a metric dimension. Allowed content belongs only in privacy-filtered local diagnostic attributes or an application-owned protected evidence store.

Threat boundaries

Trace carriers cross process boundaries and are validated as W3C metadata; they are not authorization. Secure Spores protect carrier integrity together with the payload, but receivers must still authorize message source and operation. OTLP headers authenticate export, not agent requests. Evaluation databases and telemetry backends require separate identities and permissions.

Local SQLite may contain linked identifiers and opted-in redacted content even when raw content is absent. Protect, rotate, and delete it like diagnostic data, and never publish it with the generated documentation site or release wheel.