Which review rule preserves a structured logging contract at an authentication boundary?

Which review rule preserves a structured logging contract at an authentication boundary?

1. Keep stable attribute keys and omit or redact passwords, tokens, and full payment data.
2. Log complete request objects so no debugging context is lost.
3. Build one interpolated message because log handlers cannot process typed attributes.