Veto

short stable identifier for which rule fired, surfaced on CacheEvent.WriteVetoed.reason and usable as a metrics tag. Keep it low-cardinality ("iban", "pii.email"), not a message containing the matched text — a reason that quotes the data it vetoed puts that data straight into your logs and metrics.