## When this applies
Use this when implementing or reviewing an egress content filter that screens structured payloads for identifying strings like filesystem paths or account names. Read it before the implementation begins, not after the filter has already missed something.
## The failures it prevents
Five concrete errors that produce filters which appear correct during review but fail silently in production:
### 1. Parsing before budget enforcement
**Error:** Check byte size after parsing completes rather than during the streaming parse.
**Why it fails:** Parsing itself allocates memory proportional to input size. An oversized payload exhausts heap before the check runs.
**Correct approach:** Enforce byte limit in a counting reader wrapper that aborts mid-parse when the threshold is crossed. The parser never sees bytes beyond the limit.
### 2. Heterogeneous budget units presented as composable
**Error:** Claim that depth count, byte size, and work units share one accounting system or compose into a global bound.
**Why it fails:** These are different dimensions. You cannot add them to a single counter, and multiplying per-stage caps expressed in different units does not yield a meaningful aggregate.
**Correct approach:** Maintain three independent limits with separate enforcement. State clearly that each dimension has its own threshold. For composition verification, check that per-leaf-allowance times leaf-count-cap stays under the global operation budget when both are expressed in the same unit.
### 3. Normalization order that leaves values off the canonical fixed point
**Error:** Apply Unicode normalization once, then case fold, assuming the result is canonical.
**Why it fails:** Case folding does not preserve normalization form. Two inputs that should match can diverge.
**Correct approach:** Normalize, case fold with full case folding, then normalize again. Alternatively use a precomputed combined mapping. Test that the operation is idempotent: applying it twice yields the same result.
### 4. Regex backtracking budget expressed as work units rather than timeout
**Error:** Specify a maximum work unit or step count budget for regex matching.
**Why it fails:** Standard regex libraries do not expose step counts for external budgeting. The limit cannot be enforced as written.
**Correct approach:** Use a linear-time automaton engine like RE2 which is backtracking-free by design, or enforce a wall-clock timeout with an interruptible match context. Document which approach is used and test that pathological inputs abort within the stated bound.
### 5. Single-layer decoding that misses nested encoded strings
**Error:** Parse the outer structured format and validate decoded string leaves, but do not check whether those leaves themselves contain encoded documents.
**Why it fails:** A string value containing escaped inner structure passes outer decoding. When a consumer re-parses that field, the inner escapes are processed and sensitive content is reconstructed. The log field containing escaped structured data is a common case.
**Correct approach:** Either reject any leaf that parses as the same structured format, or recursively parse nested documents with a fresh full budget stack for the inner parse. Document which choice is enforced.
## Implementation checklist
Before shipping an egress filter:
1. Byte budget enforced during parse in a counting wrapper, not after buffering completes
2. Three separate limits documented with clear units: max depth, max bytes, max wall-clock time for regex
3. Normalization is normalize, case fold, normalize again, and applying it twice yields identical output
4. Regex engine is explicitly linear-time or uses timeout-based interruption
5. Nested encoded strings are either rejected or recursively parsed with independent budgets
6. Non-convergent normalization fails closed by rejecting transmission
7. Budget exhaustion returns indeterminate verdict, keeping it separate from content rejection in metrics
8. Telemetry records only metadata: schema position, rule ID, length bucket, keyed hash. Never the rejected value.
## Limits
This captures common implementation errors. It does not replace comprehensive egress filter design guidance. See related skills for: placing caps in allocation components, three-state verdicts, per-field grammar allowlists, separator confusable tables, and hardened error paths.
## Verification status
Reasoned analysis only. The errors were identified through adversarial review of an initial design, not from executed tests or production incidents. The corrections should be validated with: inputs at each budget threshold asserting expected verdicts, pathological regex input with measured wall-clock abort time, nested encoding variants asserting uniform detection, and idempotence tests on the normalization sequence.