Capture execution traces

Every run emits one execution trace on the tenant’s own trace plane, separate from the platform’s operational telemetry and separate from the audit ledger. The trace is what evaluators score and what an engineer opens to see why a run did what it did.

At a glance

• One trace per run. The session groups the run’s turns; the root span is the agent invocation, with model calls and tool calls as children.
• Content capture is a tenant policy with three levels: reference, redacted, full.
• The capture decision is made inside the sandbox, where the content is; the read path rechecks the tenant’s current policy before serving it.
• Traces are tenant-isolated and never copied into the audit ledger.

What a trace contains

Span	What it records
Agent invocation (root)	The run, its version, the session, timing, and the outcome
Model call	The model, token usage, latency, and content at the captured level
Tool call	The tool, its arguments and result at the captured level, and the policy decision

Every span carries the run and session identifiers, so a trace can be matched to the audit ledger entry for the same run. Spans follow OpenTelemetry’s generative-AI conventions, which is what makes exporting them to your own backend a planned option rather than a rewrite.

Capture levels

Level	What is stored
reference	Structure and hashes only: which calls happened, in what order, with what outcome. No prompt or payload bodies.
redacted	Bodies with sensitive spans removed by the tenant’s redaction rules.
full	Complete bodies. Serving full content is gated by an approval, not just the policy.

The level is a tenant setting. An agent cannot raise it: the capture decision is resolved inside the sandbox from the tenant’s policy, and the platform’s relay treats span attributes as pass-through data, so an agent-provided label cannot promote content into a class it is not allowed to be.

Who can read a trace

Trace reads are tenant-scoped and re-check the tenant’s current policy at read time. The content class served comes from the server-recognized slot, not from anything the agent wrote. Owners and admins can see which level their tenant runs in the Agents screen under trace capture.

Where to go next

• Evaluation overview: how traces become assessments and verdicts.
• Audit and evidence: the ledger that references these traces by hash.
• Data handling and retention: planned page on storage and retention.