Abstract: Tasks for providing a post-redaction document to a requestor are distributed among several distinct components. The decision about whether a particular requestor is permitted to obtain a requested content item is made by an authorization service. When obtaining requested content item is permitted, the authorization service returns (a) portion identification information, and (b) redaction technique information that indicates the manner by which that portion should be redacted. Redaction is then performed by a redaction component. Techniques are described in which the portion identification information identifies portions to be redacted using XPath expressions, and the redaction component has logic to identify the portions, within the pre-redaction version of the content item, that are targeted by the XPath expressions.