The direct answer
Review the complete logger-to-handler graph before claiming a log filter covers a worker event. A parent logger’s filter does not automatically gate descendant records offered to its handlers. Bind each sink’s admitted representation to the filter and formatter on its actual route; a replacement for one handler does not establish sanitization or delivery elsewhere.
Separate a route review from a redaction slogan
A fictional trusted preprocessing worker emits bounded operational metadata through child logger C-A. Two declared internal audiences need different views: protected operator handler H-A may retain an admitted job reference, while broader internal handler H-B needs only a permitted category. An operator installs a filter on parent logger P-A and assumes both destinations now receive reviewed views.
The missing evidence is where that filter runs. This proposal addresses a separate hierarchical operational lane. The structured-audit profile keeps its dedicated logger, propagate=False and single direct handler. None of those restrictions changes here. Raw prompts, customer content, credentials and arbitrary exception metadata remain excluded.
All labels and eight cards are PROPOSED_UNRUN. No logger, handler, filter, record, event, message or output fixture was created or invoked.
Locate the actual gate on the actual path
The Python 3.15.2 reference documents this distinction. With propagation enabled, accepted child events go directly to ancestor handlers without consulting those ancestor loggers’ levels or filters. The child’s effective level still matters and can inherit an ancestor threshold when its own level is NOTSET.
Therefore a screenshot of P-A’s filter cannot establish the selected child-to-handler guarantee. The application review must locate the required control on every actual path. It must distinguish origin admission from destination admission, rather than treat the name “parent” as evidence that an ancestor logger reprocesses each event.
Our policy requires an independently established complete graph, including direct handlers, propagation boundaries and any fallback behavior relevant to the supported configuration. This is a review requirement, not a graph-discovery tool or a promise that an inspected graph stays fixed. Unknown routes block the proposed assurance.
Keep a handler-specific replacement local in the claim
The same reference says handler filters run before emission, while logger filters do not automatically cover descendant events. Since 3.12, returning a replacement LogRecord from a handler filter avoids modifying the record in place for other handlers.
For the invented plan, H-B’s separately admitted replacement R-B contains only its permitted view. That claim concerns H-B. H-A’s input and the original E-A need their own disposition; R-B does not recall, erase or sanitize them. A shared-record mutation offered as an independent destination view needs a different complete behavior review.
Review every attribute that could reach output, not just a pleasant displayed message. The selected application contract accounts for ordinary logging metadata, message arguments, cached fields, exception and stack paths, formatter behavior and output bounds. Unknown or prohibited content holds the record. No copying, replacement-construction or redaction implementation is provided.
Use an audience-and-route association sheet
| Association | Independent evidence required |
|---|---|
| Origin C-A / event E-A | Fixed trusted producer; complete bounded admitted metadata and current purpose. |
| Reachable handlers | Complete effective graph, thresholds, propagation edges and stable configuration ownership. |
| H-A protected view | Its allowed fields, actual filter/formatter plan and destination rights. |
| H-B narrower view R-B | Supported handler-local replacement, complete permitted output attributes and no raw fallback. |
| Output disposition | Independent bounded capture, retention and failure evidence for each destination. |
The useful positive preserves an ordinary permitted category for both audiences while limiting the additional job reference to its admitted internal purpose. Once every actual prerequisite is independently established, only the declared route policy becomes conditionally eligible for implementation review. No event emission or successful collection is reported.
Actual runtime support, full graph, dynamic configuration, origin field contract, replacement validation, formatter/error paths, output capture and destination rights are unimplemented or unknown. A missing row blocks the positive. A matching configuration label supplies none of those missing facts.
Preserve uncertainty when output evidence is missing
The reference documents handler error handling that can silently ignore emission exceptions when raiseExceptions is false. A returned logging call is therefore insufficient delivery evidence. The application must separately define how a missing or failed required output becomes visible to its operator.
This proposal allows no recursive logging of the rejected raw record and no automatic fallback to a broader destination. Preserve the failed or unknown output disposition without inventing a successful audit entry. A denied application action stays denied independently of whether an operational event was captured.
Keep collection, durable storage, downstream transformations, viewer rendering and retention separate. This worksheet includes no queue, exporter, collector, network service or file handler implementation. The audit-event guide still owns broader decision/outcome evidence and minimization.
Walk eight inert route cards
| Condition | Proposed disposition |
|---|---|
| 1. C-A/E-A and both declared sink plans match every prerequisite | Conditionally admit only that route policy. |
| 2. Only P-A’s logger filter is offered for the child path | Hold the unsupported coverage claim. |
| 3. An ancestor threshold is presented without origin and handler evidence | Resolve the actual admission stages. |
| 4. H-B has an admitted R-B replacement | Limit the claim to that destination; account for E-A and H-A separately. |
| 5. Shared mutation replaces the reviewed independent-view plan | Hold changed cross-handler behavior. |
| 6. Another handler or propagation edge appears | Reconcile complete route coverage before reuse. |
| 7. Required filtering, formatting or output evidence is unavailable | Keep capture unknown; no raw fallback. |
| 8. Routes match but origin content or destination rights fail | Deny that use independently. |
Keep the evidence and product claim narrow
The sole maintained body was updated on 1 November 2026 at 09:09 UTC. No installed Python, active logging graph, filter or sink was inspected. No logging import, configuration, handler operation, runtime fixture or model call occurred; ordinary editorial file handling is separate.
Boundary remains prelaunch with planned request-path checks, not a shipped logging-route verifier or universal redactor. Its existing synthetic policy checks concern different behavior. This worksheet establishes no secure erasure, all-copy minimization, tamper resistance, delivery guarantee or measured disclosure prevention.
Primary sources
Official references supporting the guidance. Examples in this guide are synthetic and are not reports of a production incident.