# ADR 0005 — Redaction by Default

**Status:** Accepted  
**Date:** 2026-06-13

## Context

Finance and Health integrations can easily leak sensitive data through fields, logs, errors and examples.

## Decision

Default display policy is `summary`. Redaction is applied before data reaches frontend or logs.

Forbidden fields are documented in `docs/security/forbidden-fields.md`.

## Consequences

- Exact values require explicit allowlist.
- Global overview remains safe.
- Errors are sanitized.
- Contract examples are synthetic.

## Defaults

- `REDACTION_DEFAULT_POLICY=summary`
- `ALLOW_EXACT_FINANCE_VALUES=0`
- `ALLOW_HEALTH_DETAIL_LINKS=0`