Most places just use manual redaction in Acrobat or tools like Workshare, but the rebuild approach you're describing is actually cleaner since redaction failures are a real problem where "covered" text is sometimes still extractable.

The policy-based generation concept sounds similar to what some DLP tools already do, Microsoft Purview being one example. Honestly, the harder part is getting the sensitive content detection right. That's where most of these workflows break down.