# Capture execution traces

What a run's execution trace contains, the three content capture levels, and who can read a trace.

Every run emits one execution trace on the tenant's own trace plane, separate from the platform's
operational telemetry and separate from the audit ledger. The trace is what evaluators score and
what an engineer opens to see why a run did what it did.

- One trace per run. The session groups the run's turns; the root span is the agent invocation,
  with model calls and tool calls as children.
- **Content capture** is a tenant policy with three levels: reference, redacted, full.
- The capture decision is made inside the sandbox, where the content is; the read path rechecks
  the tenant's current policy before serving it.
- Traces are tenant-isolated and never copied into the audit ledger.

## What a trace contains

| Span | What it records |
|---|---|
| Agent invocation (root) | The run, its version, the session, timing, and the outcome |
| Model call | The model, token usage, latency, and content at the captured level |
| Tool call | The tool, its arguments and result at the captured level, and the policy decision |

Every span carries the run and session identifiers, so a trace can be matched to the audit ledger
entry for the same run. Spans follow OpenTelemetry's generative-AI conventions, which is what makes
[exporting them to your own backend](/guides/evaluate/export-traces-opentelemetry) a planned
option rather than a rewrite.

## Capture levels

| Level | What is stored |
|---|---|
| `reference` | Structure and hashes only: which calls happened, in what order, with what outcome. No prompt or payload bodies. |
| `redacted` | Bodies with sensitive spans removed by the tenant's redaction rules. |
| `full` | Complete bodies. Serving full content is gated by an approval, not just the policy. |

The level is a tenant setting. An agent cannot raise it: the capture decision is resolved inside
the sandbox from the tenant's policy, and the platform's relay treats span attributes as
pass-through data, so an agent-provided label cannot promote content into a class it is not
allowed to be.

## Who can read a trace

Trace reads are tenant-scoped and re-check the tenant's current policy at read time. The content
class served comes from the server-recognized slot, not from anything the agent wrote. Owners and
admins can see which level their tenant runs in the Agents screen under trace capture.

## Where to go next

- [Evaluation overview](/guides/evaluate/overview): how traces become assessments and verdicts.
- [Audit and evidence](/guides/audit/audit-and-evidence): the ledger that references these
  traces by hash.
- [Data handling and retention](/guides/govern/data-handling): planned page on storage and
  retention.