myco:mcp-response-redaction-governance

Set redact_sensitive_fields via the env-var hierarchy: UNIFI_{SURFACE}_REDACT_SENSITIVE_FIELDS overrides UNIFI_REDACT_SENSITIVE_FIELDS, which overrides the config value, defaulting to true. MCP surfaces resolve per tool call, while the API surface resolves once at config load.

Remove the caller-controlled parameter from the public schema entirely, replace internal uses with should_redact_sensitive_fields and redact_sensitive naming, and derive any internal boolean from server policy only. Optionally return an explicit error naming the replacement env var.

On MCP surfaces yes, because each tool call re-resolves should_redact_sensitive_fields. On the API surface no, because the value is resolved once in load_config and cached, so a process restart is required.

Read-path redaction is not applied by middleware; every new tool, route, or resolver must explicitly call redact_sensitive_fields with the resolved boolean. A missing call at the new code path is the most likely cause.

No. Two separate mechanisms exist: PolicyGateChecker for categorized allow/deny gates and the should_redact_sensitive_fields resolver for surface-scoped values. A unified PolicyEngine was proposed but never shipped, so verify with grep before assuming it exists.