Seeing a ton of PII in our OpenClaw audit logs. Agent outputs containing names, emails, even partial credit card numbers are getting written to stdout/stderr and picked up by Fluentd. Our auditors flagged it immediately.

Current config is basic:
```yaml
logging:
driver: "json-file"
options:
max-size: "10m"
max-file: "3"
```

* This violates data minimization for SOC 2 CC6.1 and ISO 27001 A.8.2.1.
* We need to redact or suppress at source, not just in storage.

Anyone solved this? Looking for:
* Agent-side output filtering patterns.
* Log driver configs that strip fields before forwarding.
* How you scope the agent runtime vs. the application logic for the audit.

-Tom