Where it runs, what the agent costs your nodes, what leaves your network, and who can touch what.
One agent per node or host. Hard resource ceilings, compressed transport and pooled buffers keep it out of your workloads' way.
logredact scrubs API tokens and personal data inside the agent — before anything is buffered, shipped or written.