Derive Macro SensitiveDisplay 

#[derive(SensitiveDisplay)]
{
    // Attributes available to this derive:
    #[sensitive]
    #[not_sensitive]
    #[redactable]
    #[error]
}

Derives redactable::RedactableWithFormatter using a display template.

This generates a redacted string representation without requiring Clone. Unannotated fields use RedactableWithFormatter by default (passthrough for scalars, redacted display for nested SensitiveDisplay types).

Field Annotations

• (none): Uses RedactableWithFormatter (requires the field type to implement it)
• #[sensitive(Policy)]: Apply the policy’s redaction rules
• #[not_sensitive]: Render raw via Display (use for types without RedactableWithFormatter)

The display template is taken from #[error("...")] (thiserror-style) or from doc comments (displaydoc-style). If neither is present, the derive fails.

Fields are redacted by reference, so field types do not need Clone. A custom PolicyApplicableRef leaf nested inside a container can explicitly select its ordinary borrowed projection with #[redactable(legacy_formatting)]. The explicit route does not require the direct-leaf formatting marker; it requires PolicyApplicableRef on the whole field and the selected format capability on its output. It inherits the projection’s Clone requirements and borrow behavior; library-owned fields should stay on the default conflict-safe route. It composes with #[redactable(recursive)], retaining the projection/output bounds while suppressing the cyclic inferred field bound.

#[redactable(generated_formatting)] instead selects the library-owned recursive formatter for an alias-hidden or otherwise ambiguous container field. legacy_formatting and generated_formatting are mutually exclusive, and standalone Sensitive rejects both (they only affect display output).

Use SensitiveDual instead when the same type also needs structural redaction.

Generated Impls

• RedactableWithFormatter: always generated.
• ToRedactedOutput: always generated; emits the redacted display text and certifies the type for slog_redacted_display() and tracing_redacted().
• Debug: redacted by default; actual values in the consumer’s cfg(test) builds or when redactable’s testing feature is enabled.
• slog::Value + SlogRedacted: emits the redacted display string (requires slog feature).
• TracingRedacted: marker trait (requires tracing feature).