When an enquiry fails, a supplier may log the entire request to make debugging easier. That can copy messages, attachments and credentials into a second system. Commission a small operational event with approved fields, and test what is excluded as carefully as what is retained.
Primary evidence and claim boundaries
OWASP’s logging guidance identifies data such as access tokens, authentication secrets and sensitive personal information for exclusion or protected handling, and calls for sanitising event data against log injection. Primary reference · Read 18 October 2026.
Filled acceptance example
Original synthetic teaching scenario, not a client case, provider integration test or business result. The example policy needs the actual owner’s approval; scroll the table on narrow screens.
| Input and state | Declared check | Expected output and decision |
|---|---|---|
| Synthetic failed event has requestID R18, codeMAIL_TIMEOUT, elapsed850ms | Approved operational allowlist | Retain R18, MAIL_TIMEOUT,850; no message body |
| Request also contains Authorization and email | Not in approved event schema | Drop from log event; never hash a token and call it harmless |
| User text includes a newline and fake SUCCESS record | Raw interpolation into a text log | Reject raw interpolation; use reviewed structured encoding |
| Log write fails but enquiry outcome is unknown | Separate diagnostic and business states | Record logging failure safely; do not invent enquiry success |
Practical handover procedure
- Have the owner approve event fields, purpose, access and retention. Use an opaque request ID rather than copying contact details to identify the event.
- Build the synthetic request with both allowed and deliberately excluded fields. Inspect the final emitted event and all configured sinks, not only the first console line.
- Exercise newline content and a failed log sink in isolation. Verify credentials/message text remain absent and enquiry receipt, mail delivery and diagnosis remain distinct.
Interpret the outcome
The retained event is useful for tracing a timeout without duplicating the form. A field allowlist also gives a concrete negative test: adding a new form field must not automatically add it to logs. Redaction is a maintained data-flow decision, not a promise made by an error-code label.
Acceptance decision
Require only approved fields in every observed sink and a tested failure path. Unauthorised sink access remains outside the test; record it as unverified.
Limits and unverified work
Synthetic request only; no real enquiry, logs, customer information, mail or third-party telemetry is accessed or sent. Retention and legal basis need separate owner decisions.
Download the filled bilingual acceptance record — Contains the inputs, steps, expectations and limits. This is a teaching record, not an executable production integration.