# agent's audit evidence had PII in screenshots: redaction pass

## TL;DR

The evidence screenshots captured PII (names, emails, IDs) alongside the proof, creating a privacy incident inside a compliance artifact. Add a redaction pass: blur or mask PII regions before the screenshots enter the evidence store. Evidence must prove the control, not expose the data.

```text
agent's audit evidence had PII in screenshots
```

## Steps

1. Inventory the affected screenshots and the PII types visible.
   Expected: The exposure is mapped.

2. Redact the stored copies: blur or mask the PII regions.
   Expected: The evidence is clean.

3. Restrict access to the unredacted originals until they are replaced or purged.
   Expected: The exposure is contained.

4. Add the redaction pass to the evidence pipeline: every screenshot gets reviewed or auto-redacted before storage.
   Expected: Future evidence is clean by default.

5. Check the retention: purged originals must actually be purged, including backups.
   Expected: The PII is gone, not just hidden.

## When to use

- evidence screenshots contain PII
- screenshots are captured automatically
- the evidence store is broadly shared

## When not to use

- the PII is the evidence (then get explicit authorization and restrict access)
- screenshots are already redacted (verify the redaction quality)
- no screenshots are taken (nothing to redact)

## Tool compatibility

- any evidence collection
- screenshot redaction

## Variant phrasings

- "audit evidence PII screenshots"
- "redact PII evidence screenshots"
- "screenshots contain personal data audit"

## Why it happens

Evidence screenshots are taken to prove a control, and the screen often shows more than the control: user lists, emails, personal data. The evidence store then becomes a PII store with compliance-grade retention. Redaction at capture keeps the proof while removing the personal data.

## Edge cases

- auto-redaction needs verification; it misses novel PII layouts
- the purge must cover backups, or the PII survives the cleanup
- the authorization for PII-as-evidence must be explicit and documented

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_gOgVdNYiWSDUp7z9G6LT2w