16.9Log enough context, but not the whole payload

Good:

{
  "event": "customer_processing_failed",
  "customerId": "C001",
  "correlationId": "REQ-8F21",
  "errorType": "SALESFORCE:TIMEOUT"
}

Bad:

payload = entire customer object
headers = all request headers

because that may expose:

OAuth tokens
PII
PHI
financial data
credentials

Use allow-listed fields.