BlueprintPage 35
35OPERATIONS
Observability & Telemetry
Record enough to explain and investigate—without collecting sensitive content merely because it is available.
- Priority
- P0
- Phase
- MVP
- Primary owner
- Platform / SRE
- Status
- Blueprint
Objective
Observability must capture what agents attempted, why controls responded, and what ultimately happened. The telemetry system should serve security operations without becoming an uncontrolled warehouse of sensitive prompts and business data.
What to build
- Structured events for agent sessions, tool calls, policy decisions, approvals, downstream results, costs and errors.
- Distributed trace IDs across agent → gateway → tool → result chains.
- Health telemetry for connectors, gateways and policy distribution.
- Configurable content capture: full, redacted, hashed or metadata-only.
Implementation decisions
- Design events for high-cardinality attributes such as agent, tool and tenant while controlling cost.
- Separate operational metrics from security evidence retention.
- Provide streaming export to SIEM/data platforms.
- Protect telemetry integrity and administrative access.
Definition of done
- A support engineer can trace a failed protected action end-to-end.
- Customers can select retention/content modes by data class.
- Telemetry pipeline backpressure does not interrupt deterministic enforcement.
Success metrics
- Event ingestion rate
- Dropped-event rate
- Trace completeness
- Telemetry storage cost per 1M events
OPERATING PRINCIPLE
Record enough to explain and investigate—without collecting sensitive content merely because it is available.