Agent observability becomes a security control when it can answer five questions: which identity initiated an action, what the agent requested, which policy decision authorized it, what resource changed, and whether the resulting trajectory remained inside the approved objective.
Latency, token counts, and model errors remain useful. They are not enough to investigate a destructive tool call, revoke active authority, establish which tenant was affected, or prove that recovery completed.
Debug traces and security evidence have different jobs
Debugging asks why software failed. Security review asks whether an actor or automated system crossed an authority boundary, whether the action was prevented or completed, and what must be contained.
OpenTelemetry semantic conventions provide shared meaning for spans, metrics, logs, and events, allowing telemetry from different components to be correlated. OpenTelemetry semantic conventions The security design still has to decide which identities, policy decisions, resource references, and effects must survive that correlation.
At minimum, a security-relevant trajectory needs:
| Layer | Evidence |
|---|---|
| Initiator | Human, service, tenant, session, and delegation context |
| Agent | Stable agent/workflow identity and version |
| Input | Provenance and trust classification, not indiscriminate raw capture |
| Tool request | Tool identity, operation, constrained parameters, and request ID |
| Credential | Workload or delegated identity used, without logging the secret |
| Authorization | Policy version, decision, reason, approval, and enforcement point |
| Resource | Stable resource identity and precondition |
| Effect | Attempted, denied, completed, partially completed, or rolled back |
| Outcome | Business result, downstream calls, and recovery state |
The trajectory matters more than an isolated valid call
An individual action can be syntactically valid and authorized while the sequence is dangerous. An agent might read a document, retrieve a credential-scoped tool, modify a configuration, and notify an external system. Each step can pass its local check. The combined trajectory can still violate the user’s objective or cross a trust boundary.
Security analysis therefore needs correlation across tool calls and downstream effects. It also needs an independently controlled decision record. If the same model proposes the action, explains why it is safe, and supplies the only log, the evidence shares the failure domain being investigated.
Identity is the join key
NIST/NCCoE’s draft concept work identifies software and AI-agent identity, authorization, delegation, logging, transparency, and data-flow tracking as related enterprise controls. It proposes linking actions to a non-human identity and linking delegated authority back to the human context. NIST/NCCoE concept paper
Without those joins, a trace might show that tool.call occurred but not which principal could make the call, which user delegated authority, which policy was evaluated, or which resource accepted the result. A reusable correlation envelope should carry stable identifiers rather than display names and should survive asynchronous work, queues, retries, and handoffs between agents.
Do not turn observability into a data leak
OpenTelemetry moved GenAI conventions out of the core registry into a dedicated repository. Its current agent/framework document is marked Development and defines spans for creating and invoking agents, invoking workflows, and planning. The exact fields relevant to that portion of the model include gen_ai.operation.name, gen_ai.agent.name, gen_ai.provider.name, and gen_ai.request.model. OpenTelemetry GenAI agent and framework spans
The linked execute-tool convention defines gen_ai.operation.name as execute_tool, requires gen_ai.tool.name, recommends gen_ai.tool.call.id when available, and makes gen_ai.tool.call.arguments and gen_ai.tool.call.result opt-in because they may contain sensitive information. OpenTelemetry execute-tool span
Security telemetry should therefore default to:
- stable references, hashes, classifications, and sizes rather than raw secret-bearing content;
- allowlisted structured parameters rather than arbitrary serialized tool payloads;
- separate restricted evidence storage for content needed in an investigation;
- tenant-aware access control and retention;
- redaction before export;
- integrity protection and clock/correlation quality sufficient for reconstruction.
Sampling also needs a security exception. Cost-based sampling that drops denied calls, privilege changes, approvals, kill-switch events, or recovery actions can remove the evidence most needed during an incident.
Containment and recovery
Useful observability connects detection to action. A responder should be able to identify the agent and active session, revoke or constrain the credential, stop queued work, identify completed downstream effects, and confirm rollback or recovery. “The process stopped” is not proof that previously issued actions stopped.
This makes observability part of the control loop:
request → authorization → action → effect evidence → detection → interrupt/revoke → recovery verification
Practical takeaways
Instrument the authority path, not only the model call. Preserve identity, delegation, authorization, resource, effect, interruption, and recovery evidence. Minimize sensitive content, protect the evidence independently, and test whether a responder can reconstruct one complete trajectory before calling the system observable.
Continue with Capability, Authority, and Reach for the full agent security model and Threat Modeling AI Agents for a control-and-evidence review method.
Limitations
Telemetry cannot compensate for excessive authority or an absent enforcement point. Complete-looking traces can still be wrong, delayed, attacker-influenced, or missing downstream state. Recording prompts and tool data can itself create a high-value sensitive dataset. OpenTelemetry marks the dedicated GenAI conventions as Development, so an implementation must pin and recheck the convention version and schema URL rather than treating these field names as permanently stable.