## TL;DR

The redaction rules target the wrong patterns: totals got masked while full card numbers stayed visible, which is exactly backwards for both privacy and auditability. Fix the patterns so card numbers (long digit sequences, PAN patterns) are redacted and totals stay readable, then re-run redaction over the stored receipts. Verify with a sample: card numbers hidden, totals visible.

## Error

```text
agent redacted the totals instead of the card numbers  -  pii filter inverted
```

## Steps

1. Confirm the inversion on a sample of redacted receipts: totals masked, card numbers visible. Expected: the backwards pattern is clear.
2. Inspect the redaction rules for swapped or overly broad patterns. Expected: the rule targeting totals and the missing rule for card numbers are identified.
3. Rewrite the rules: redact PAN-like sequences (13 to 19 digit runs, spaced or dashed card numbers) and leave totals, dates, and merchant names intact. Expected: the rules match card numbers only.
4. Re-run redaction over all stored receipts processed by the inverted filter. Expected: the stored set now shows card numbers redacted and totals readable.
5. Add a verification sample to the pipeline: automated check that totals are present and no unredacted PAN pattern remains. Expected: future inversions fail the check loudly.

## When to use

- A PII filter redacts totals instead of card numbers.
- Stored receipts show visible card numbers.
- Auditing a redaction pipeline's correctness.

## When not to use

- Everything numeric is redacted (an over-broad pattern, different fix).
- Nothing is redacted at all (the filter is not running).
- The card numbers are already properly masked.

## Tool compatibility

Applies to custom audit agents with PII redaction (regex or ML-based redaction; current 2026 releases).

### Variant phrasings

### card numbers visible in "redacted" receipts

The PAN pattern is missing from the rules. Add it.

### totals blacked out on stored receipts

The total pattern is wrongly targeted. Remove it from redaction.

### redaction audit failed on receipt storage

Sample-verify: totals readable, card numbers hidden.

## Why it happens

Redaction rules are pattern lists, and a swapped or mislabeled pattern inverts the protection silently: the pipeline reports success while doing the opposite of its job. Totals look like the thing to hide (they are prominent numbers), but they are the audit evidence, while card numbers are the actual PII. The verification sample exists because redaction correctness cannot be judged from the pipeline's own success signal.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_dLp19n-8UiOZhylDPaPl5w