Redaction

Content policies can transform data inline with redact or remove elements from a structured tool result with filter.

Redaction strategies

`strategy`	Required parameters	Output
`constant`	`replacement` string, max 1,024 characters	Replaces every selected value with the exact string; an empty replacement is valid
`partial`	`keepStart` or `keepEnd`; optional `maskCharacter`	Preserves the selected prefix/suffix and masks the remaining characters
`hash`	Optional `saltRef`	Returns a deterministic organization-keyed SHA-256 digest
`nullify`	None	Replaces every selected value with JSON `null`
`fake`	`subtype`	Returns deterministic, non-production synthetic data with the selected shape

For partial, keepStart and keepEnd are integers from 0–256. maskCharacter is exactly one character and defaults to *. Non-string targets fail the transformation. hash.saltRef is an identifier used for domain separation, not a literal secret. Equal inputs within the same organization and salt reference produce equal output. fake.subtype accepts:

Value	Output shape
`string`	Stable synthetic text
`email`	Stable address in the reserved `example.invalid` domain
`phone`	Stable phone-shaped test value
`ipv4`	Stable address from a documentation/test range
`payment_card`	Stable payment-card-shaped value that is not a usable credential

Structured paths

paths is optional. Without it, Forge transforms the whole value available at the selected checkpoint. With it, Forge transforms 1–64 selected values inside a structured pre_tool input or post_tool result. Supported path syntax:

$
$.env.TOKEN
$.rows[0].email

Paths are 3–512 characters and support:

the root $;
property segments such as .env;
zero-based array indexes such as [0].

Property names begin with a letter or underscore and may contain letters, numbers, _, or -. Wildcards, recursive descent, quoted keys, filters, slices, and negative indexes are not supported. When matching transformations overlap, Forge selects:

nullify > hash > fake > partial > constant

Filtering

filter is valid only at post_tool. It removes elements from one structured array while preserving the order of retained elements.

Field	Required	Input
`collectionPath`	Yes	Path to the array whose elements may be removed
`removeWhere.path`	Yes	Path evaluated relative to each array element
`removeWhere.op`	Yes	`eq`, `neq`, `contains`, `starts_with`, `ends_with`, `gt`, `gte`, `lt`, or `lte`
`removeWhere.value`	Yes	JSON-typed comparison value
`onUnavailable`	Yes	`allow` or `block`

Example:

{
  "action": "filter",
  "evaluateOn": ["post_tool"],
  "filter": {
    "collectionPath": "$.rows",
    "removeWhere": {
      "path": "$.classification",
      "op": "eq",
      "value": "sensitive"
    },
    "onUnavailable": "block"
  }
}

If collectionPath or the predicate path cannot be evaluated, onUnavailable: "allow" returns the original result unchanged. onUnavailable: "block" converts the transformation failure into a blocked outcome. Forge does not coerce comparison types.

Get started

Observe

Secure

Enable

Integrations

Resources

Redaction strategies

Structured paths

Filtering

​Redaction strategies

​Structured paths

​Filtering

Redaction strategies

Structured paths

Filtering