[FEATURE] - GDPR Compliance: Redact User Messages in OpenTelemetry Traces

[andormarkus]

Problem Statement

Strands SDK exports full user message content, agent responses, tool parameters, and tool results to OpenTelemetry traces. Under GDPR Article 17 (Right to be Forgotten), ANY user data must be deletable upon request - even innocuous content like cooking recipes. Once data enters telemetry systems (OTLP collectors → immutable storage → backups → third-party vendors like Datadog/New Relic), deletion becomes operationally impossible.

Affected code: src/strands/telemetry/tracer.py - methods like _add_event_messages(), end_model_invoke_span(), end_tool_call_span()

Proposed Solution

Add message content redaction controlled by environment variable, defaulting to secure (redacted).

Environment variable:

OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=false  # default (secure)
OTEL_INSTRUMENTATION_GENAI_CAPTURE_MESSAGE_CONTENT=true   # opt-in for development

Implementation:

1. Add env var parsing in Tracer.__init__()
2. Add redaction helpers that replace content with <redacted> while preserving structure
3. Apply redaction in all trace methods that capture messages/tool data

What's preserved: Trace structure, timing, tool names/IDs/status, errors, performance metrics
What's redacted: User messages, agent responses, tool parameters, tool results

Use Case

Production (default): Messages show as <redacted> - full observability without GDPR obligations
Development (opt-in): Full content visible for debugging

Alternatives Solutions

1. Disable message events entirely - ❌ Loses observability
2. Hash-based pseudonymization - ❌ Hashes are still personal data under GDPR
3. Length-preserving masking - ❌ Leaks information
4. Partial redaction - ❌ Still exposes user data

Additional Context

Backward compatibility: Secure by default. Existing users needing full content set env var to true.

Why this matters: Telemetry systems are designed for retention, not deletion. A user asking about recipes has the same right to deletion as sensitive data. Prevention (redaction) is the only practical compliance solution.

I'm happy to submit PR