Service level indicators
Reliability metrics do not need customer payloads
Measure outcomes with bounded labels and controlled diagnostic links. Keep sensitive request content out of general monitoring systems.
In this article
Separate counts from investigation records
An indicator usually needs facts such as operation class, outcome and duration. It rarely needs the full customer request or document content.
Use stable operation identities in restricted diagnostic records when individual investigation is necessary. Keep metric labels bounded so every user or request does not create a new time series.
This also improves operational clarity. A chart split into thousands of customer identifiers is difficult to interpret during an incident.
Review automatic instrumentation
Inspect what tracing and error tools collect by default. URLs, query parameters, headers and exception messages can contain sensitive information even when the explicit metric is safe.
Use synthetic sensitive values in a test and follow them through logs, traces and alert notifications. Check failure paths and retries, not only successful requests.
Configure redaction and collection boundaries at the appropriate source rather than relying solely on people avoiding screenshots later.
Control the diagnostic path
Give operators enough authority to investigate the affected service without granting unnecessary access to all customer data. Separate general health dashboards from detailed payload inspection.
Record who can follow an operation identifier into a sensitive record and how that access is audited under the service's policy.
A monitoring vendor or shared platform may create another data destination. Include its actual collection and retention behaviour in the review.
Keep evidence proportionate
Retain the counts and incident evidence needed for reliability decisions while limiting unnecessary detailed data. Choose retention according to the content and purpose rather than one blanket duration.
When sharing an incident summary, describe affected operations and outcomes without copying customer payloads into broad channels.
The access review should show that the team can measure and diagnose service quality without making observability an uncontrolled second application database. Good instrumentation is precise about what happened and restrained about the content it carries.
Primary sources
OWASP: logging guidanceReferences checked 11 September 2026.