Redaction policy
Not yet checked on the product
This chapter was written from the product's source code and has not yet been checked by a person on a running Cogneris. If what you see on screen differs, the screen is right — please tell your Cogneris contact so the chapter can be corrected.
Each template can carry a redaction policy: the sensitive-data categories Cogneris covers when a document of this template is redacted, how sure a detection must be, how the output image is produced and how long the redacted file is kept. A policy is edited as a draft, validated against the tenant ceiling and published; a published version can never be changed.
| How to get here | Templates › open a template › Redaction tab (next to Schema and Agent). See Templates. |
| Who can use it | Company or platform administrators. The screen opens for the roles tenant.admin, cogneris-admin and cogneris-platform-admin — the same roles the service accepts. Anyone else sees Company or platform administrator access required — Ask a company or platform administrator to configure and publish this policy. |
| Content status | From source; not observed (vision-fe 0b724a0, vision-be fce7fcc, 2026-10-22) |
How a policy moves
- Tenant ceiling first. The company has one redaction ceiling: the categories any template may redact and the maximum retention. It is configured in Company administration, not on this screen. Without it no draft can be created: A tenant Redaction ceiling must be configured in Company administration before a draft can be created.
- Create draft. The first draft of a template starts from the ceiling: every category the ceiling allows is selected, retention is 24 hours (or the ceiling's maximum, if lower), raster DPI is 300, no per-category confidence threshold is stored, and every category gets a solid black box. Later drafts are a copy of the latest published version. A template has at most one unpublished draft at a time.
- Edit and Save draft. Each save increases the draft's Revision.
- Validate. The service checks the saved revision against the current ceiling.
- Publish. After a confirmation, the version becomes immutable and is used for new redaction jobs of this template.
The screen header shows Draft version … and Revision … while a draft is open.
Screen states
| What you see | When |
|---|---|
| Loading redaction policy... | The draft or the version history is loading. |
| The redaction policy could not be loaded. with Retry | Loading failed. The error message, if any, is shown under the title. |
| Create a redaction policy draft — Start from the active tenant ceiling or the latest published version. with Create draft (Creating... while it runs) | The template has no draft and no published version. |
| Published version … — This version is immutable and is now available to Redaction workflows. with the publication time and the first 12 characters of its content hash | No draft is open and a published version exists, or a version was just published. Buttons: Create new draft, View version history / Hide version history. |
| The editor (ceiling banner, two cards and the Publication rail) | A draft is open. |
Tenant ceiling banner
Shown above the editor.
| Element | What it shows |
|---|---|
| Tenant ceiling and the Active chip | The ceiling is configured. The line under it reads Revision … · … categories allowed · … hours maximum retention. |
| Warning style, no chip | No ceiling is configured: A tenant Redaction ceiling must be configured in Company administration before a draft can be created. |
Sensitive-data categories
Select the subset this template may redact. Categories outside the tenant ceiling remain visible but cannot be selected.
The 13 categories are grouped in four columns. A category the ceiling does not allow is shown greyed and its checkbox is disabled.
| Group | Category (label) | Service name |
|---|---|---|
| Identity and biometrics | Full name | FullName |
| Date of birth | DateOfBirth | |
| Face | Face | |
| Signature | Signature | |
| Government identifiers | Tax ID | TaxId |
| Document number | DocumentNumber | |
| Passport | Passport | |
| QR or barcode | MachineReadableCode | |
| Contact details | Address | Address |
| Phone | Phone | |
Email | ||
| Financial | Bank account | BankAccount |
| Payment card | PaymentCard |
When you select a category, it gets the opaque black box style, and the current shared confidence threshold if one is set. At least one category is required.
Detection and output
Fields
| Field | What it does | Required | Format / values | Default | Validation messages |
|---|---|---|---|---|---|
| Shared confidence threshold | Confidence a detection must reach to count as a confident one, applied to every selected category. Shows Mixed (empty field) when the selected categories have different thresholds; typing a value sets all of them. | No | Number 0–1, step 0.01 | 1 (no threshold stored means 1) | Confidence must be between 0 and 1. |
| Redaction style | How each region is covered. The only option is Opaque black box: solid black (#000000), fully opaque, no label, 1-pixel margin. Shows Mixed when any selected category has a different style. The margin does not count: the 4-pixel black box a new draft starts with reads as Opaque black box. Picking Opaque black box rewrites every selected category to it. | Yes | Opaque black box | See left | — |
| Raster DPI | Resolution at which pages are rasterized before detection and covering. The output is always a raster image, never the original file with boxes on top. | Yes | Whole number 200–600 | 300 | Raster DPI must be a whole number between 200 and 600. |
| Temporary retention (hours) | How long the redacted artifact and its job are kept before they expire and are cleaned up. Stored in seconds; the screen shows hours. | Yes | Whole hours, 1 up to the ceiling's maximum | 24, or the ceiling's maximum if lower | Retention must be greater than zero. · Retention cannot exceed the tenant ceiling. |
The service also accepts per-category thresholds and styles (colour #RRGGBB, opacity exactly 1, optional label REDACTED, margin 1–4,048 pixels). This screen sets them all at once and offers only the black box; values written in another way are kept until you change the shared control.
Other validation messages shown in the editor:
- Select at least one category.
- Remove categories that are outside the tenant ceiling.
Publication rail
| Step | Done when | Text |
|---|---|---|
| 1 | No unsaved edits | Draft saved / Unsaved changes |
| 2 | The current revision passed Validate | Validated against the current ceiling / Validation required |
| 3 | Steps 1 and 2 are done | Ready to publish / Save and validate this revision to publish |
Under the steps: Published versions are immutable.
Buttons and actions
| Button | What happens | Who | Reversible? |
|---|---|---|---|
| Create draft / Create new draft | Creates a draft from the ceiling (first time) or from the latest published version. | Administrators | Yes — a draft can be edited freely and is replaced by the next one |
| Save draft (Saving...) | Checks the form, then saves it as a new revision. Enabled only when something changed. The service checks the categories and retention against the ceiling again. | Administrators | Yes |
| Validate | Asks the service to check the saved revision against the current ceiling. Enabled only when there are no unsaved edits. Any later edit clears the result. | Administrators | — |
| Publish | Opens the confirmation dialog. Enabled only when the current revision is saved and validated. | Administrators | — |
| Publish version … (in the dialog Publish redaction policy? — Version … will become immutable after publication.; Publishing... while it runs) | Publishes the version. The service locks the ceiling, re-checks the draft, records the publication time and a SHA-256 content hash, and writes an audit entry. | Administrators | No. A published version cannot be edited or deleted. To roll back, publish a new version with the old settings. |
| Cancel (in the dialog) | Closes the dialog without publishing. Also closed by Escape or by clicking outside. | — | — |
| View version history / Hide version history | Shows or hides the Version history card. | Administrators | — |
| Retry | Reloads the policy (after a load failure, or after a stale-draft error). | Administrators | — |
Version history
Lists up to 100 versions of this template's policy, or No policy versions yet.
| Column | Content |
|---|---|
| Version | Policy version number. |
| State | Published or Draft. |
| Publication time | Date and time of publication; — for a draft. |
| Ceiling revision | Revision of the tenant ceiling the service reports with the version; — when it reports none. |
| Content hash | First 12 characters of the SHA-256 hash of the published settings; — for a draft. |
If the history fails to load, the card shows The request could not be completed. Try again. with Retry.
What the service does with a published policy
- Only the latest published version is used. When a redaction job starts for a template, the service takes its latest published version. A draft is never used. Without a published version the job is refused.
- The ceiling is re-checked at use. If the ceiling has since been narrowed so that the version's categories or retention no longer fit, the job is refused as outside the ceiling. Publish a new version that fits.
- Jobs keep their policy. Each job stores a snapshot of the policy it started with; publishing a new version does not change jobs already running.
- Detection. Pages are rasterized at Raster DPI and only the selected categories are looked for. Each detection is compared with its category's threshold: a detection below the threshold is still covered, but it is flagged low-confidence (
redaction.low_confidence) in the job's manifest. - Covering and verification. Regions are covered with the category's style. An independent check then looks for any sensitive data left; if it finds some, the regions are widened by 8 pixels and covered again, up to 6 times. If data is still found, the job fails (
redaction.residual_pii_detected). - Retention. The job and its artifact expire at the job's start time plus Temporary retention, and are then cleaned up.
- Limits. A document can have at most 100 pages and 100 MiB.
- Redaction is available only where the service's redaction feature is enabled for the tenant.
Common problems
| Message | Cause | What to do |
|---|---|---|
| A tenant Redaction ceiling must be configured in Company administration before a draft can be created. | The company has no redaction ceiling. | Configure the ceiling in Company administration, then Create draft. |
| Company or platform administrator access is required. | The service refused your role. | Ask a company or platform administrator. |
| This draft changed elsewhere. Reload the latest revision before continuing. | Someone saved, validated or published this draft after you loaded it. The editor is locked. | Click Retry to reload the latest revision, then redo your changes. |
| The draft conflicts with the current tenant ceiling. | A selected category or the retention is outside the current ceiling. The affected fields are listed under the message. | Remove the listed categories or lower the retention, save and validate again. |
| The draft could not be validated. | Validate failed for another reason. | Try again; if it persists, reload. |
| The request could not be completed. Try again. | Any other failure. | Try again. |
| Publish stays disabled | The revision has unsaved edits or was not validated. | Save draft, then Validate. |
Related
Last reviewed 2026-10-22 · Version 1.0.0 · Owner: product-documentation