How do I capture prompts and completions without leaking PII?

Turn on the opt-in gen_ai.input.messages and gen_ai.output.messages attributes, then redact before export: the spec marks both opt-in specifically because they’re likely to carry PII, but it doesn’t redact anything on your behalf, so what actually leaves your traces is still yours to control. The spec allows an instrumentation to filter or truncate that content before it’s captured, but that’s optional per library, not a guarantee you can build on across frameworks.

The reliable point to redact is wherever content leaves the process, commonly a rule in the OpenTelemetry Collector’s redaction processor matching known patterns, an email address, a key prefix, before the batch exports. That only catches what the rule was written to look for, so check it against your own traffic’s actual shape rather than trusting a generic pattern list: a customer ID sitting mid-sentence in a chat transcript doesn’t look like the PII a default rule expects.