Privacy boundaries in logs
Which fields belong in an investigation log, and which ones should never be copied.
Logs are part of the system. A field copied for debugging becomes a record someone else can read.
- Keep the event.
- Drop the payload.
- Write down why.