Context Redactor enforces tenant scoping at the prompt level. When an agent loads context (recent incidents, runbooks, knowledge-base pages) into a prompt, the redactor confirms every piece belongs to the calling tenant. Anything from a different tenant is stripped. The model never sees a foreign org id, even by accident.
The data plane already filters by org_id, so cross-tenant reads should be impossible. Context Redactor is defense in depth: a second, independent enforcement that does not trust the data plane to be perfect. If a bug or a misindexed cache returns a foreign item, the redactor catches it before the model sees it.
Context items include runbooks, past-incident summaries, knowledge-base pages, and schema descriptions. Every item carries a signature including its origin org_id. The redactor compares the signature to the calling tenant. Match is allowed. Mismatch is replaced with a [REDACTED] placeholder. Missing signature is treated as mismatch.
Audit mode runs the redactor in shadow. It logs everything that would have been redacted but does not actually strip from the prompt. Use it to debug context loaders that are over-fetching, or to validate a new signature scheme before turning it on. Production tenants always run with redactor live.
The redactor exposes its own SLIs: redaction rate, cross-tenant attempts, signature coverage. These show up as a meta-row on Service Health Matrix so the platform itself is held to the same reliability standard as the services it watches.
Subscribe to Nova AI Ops on YouTube for demos, tutorials, and feature deep-dives.
Even when a query plan accidentally returns cross-tenant context, the redactor catches it before the model ever reads it.