The in-process redaction design is the part I would want to evaluate first. Is there a way to audit which values were captured and which redaction rule matched for each probe hit?

we do show what data got redacted, we do not show which rule was used to match it yet.

all the rules get compiled into a single regex pattern, that lets us save on iterations.