Log redaction belongs before the model sees the payload. I strip secrets and PII in the tool layer so a curious prompt cannot leak them later.