Potential PII nightmare. You're now potentially circumventing access controls from sensitive data.

Tbh, it doesn't seem much different than having to watch out for not stuffing PII in logs.

Besides, with wide events, it seems possible to apply data lineage ideas and mark certain fields as sensitive and restrict access to them.

To me this seems easier than the alternative model (logs, metrics, traces), in that you only have one abstraction to contemplate handling PII in?

In what way is this worse than the alternative?