Payload capture is an opt-in evidence feature. It is disabled when a tenant has no configuration and remains disabled until a key with payload:write enables it.
Enabling capture is your organization’s processing instruction. It does not establish end-user consent or another lawful basis. Document the purpose and lawful basis before enabling it.
OpenTelemetry
For a span classified as generative AI, capture can read these emitted attributes:
gen_ai.input.messages, as a JSON object or array encoded as a stringgen_ai.system_instructions, as a JSON object or array encoded as a stringgen_ai.retrieval.query.text, as a string
Your application or instrumentation must emit these attributes. Enabling capture does not cause an OpenTelemetry emitter to collect content, and many instrumentations omit content by default. Malformed values are dropped. Output messages and retrieved documents are not captured.
MeshAI proxy
The proxy supports input normalization for OpenAI, Anthropic, NVIDIA, Google Vertex, and AWS Bedrock requests. It selects textual system, message, prompt, and input fields from supported inference requests. Unknown fields, response or output fields, authorization data, headers, binary content, and image URLs are excluded.
Capture occurs only for requests that pass governance and prompt-injection checks and are about to be forwarded. A request blocked before provider forwarding is not captured. Streaming and non-streaming requests use the same input capture path. Provider responses and completions are never captured.
Redaction and bounds
Mandatory redaction runs before tenant rules and covers common emails, Social Security numbers, payment card numbers, phone numbers, IP addresses, and known secret patterns. Tenant rules then redact matching configured fields and patterns. Mandatory redaction cannot be disabled, and tenant rules cannot restore a value removed by a mandatory rule.
The result is pattern-sanitized evidence, not anonymous or PII-free data. Names, addresses, unrecognized identifiers, and novel secret formats can remain. Minimize content at the emitter and application boundary rather than relying only on pattern matching.
Redaction uses bounded regular-expression execution. A timeout or redaction error discards the capture rather than storing unredacted content. Oversized raw inputs are also discarded, and sanitized payloads that exceed the storage bound are stored only in a truncated envelope. Raw content is not queued or deliberately written to application logs, policy-evaluation rows, audit details, or error descriptions by the capture pipeline.
Retention and disabling
Configure a retention period from 1 through 30 days, limited further by your plan’s telemetry retention. Payload content is not eligible for unlimited retention. The expires_at value is fixed when each sanitized record is created, so changing retention affects new records only. Expired records are removed by a scheduler and can remain after the recorded expiry until that scheduler runs.
Disabling capture stops requests that observe the disabled configuration from starting capture. Work already in flight or queued can still finish. Disabling does not delete existing sanitized records; they remain until scheduled expiry deletion or a separately administered tenant purge.
Missing evidence and failures
Capture is best effort and never causes an otherwise valid LLM request or trace ingest to fail. The proxy performs a bounded configuration lookup and sanitization before forwarding, so enabled capture can add pre-forward latency; persistence then runs asynchronously. Configuration lookup failures, unsupported or malformed input, missing emitter attributes, size limits, redaction failures, a full asynchronous queue, and database write failures can all produce a missing record.
A missing record is a gap in recorded evidence. It does not prove that the original request contained no input. Proxy capture drops are not persisted as durable gap records, so absence alone cannot identify the cause. MeshAI can attest only to the content it received and retained under this policy, not that omitted telemetry represented the complete application input.
The public API currently configures payload capture only and does not provide a sanitized payload read, export, delete, or self-service data-subject-request endpoint. Tenant deletion purges tenant payloads, and deleting an owning agent cascades to that agent’s payload rows; other access or deletion handling is operator-controlled and scoped.
See the Payload Capture API for exact request and response examples. 
