Start with one operational question, define mutually exclusive labels, and make sure each label routes to a concrete workflow. Then choose the narrowest trace slice that contains the evidence needed for that label. If the facet cannot produce stable results across reruns, it is not ready for production review.
Why This Matters for Security Teams
Custom facets are not just a reporting convenience. In AI agent trace data, they become the mechanism that turns raw execution logs into reviewable evidence for safety, abuse detection, and operational accountability. When teams design facets poorly, they usually create overlapping labels, ambiguous routing, and inconsistent reviewer outcomes that make trace analysis harder instead of easier. That problem is especially visible when traces mix tool use, prompt content, policy decisions, and post-processing steps in one event stream.
The security value is straightforward: a well-designed facet should help answer a specific question such as whether an agent attempted prohibited tool access, whether a retrieval step introduced untrusted content, or whether a decision was made from stale context. That is why NIST’s NIST AI Risk Management Framework is relevant here. It pushes teams toward measurable governance, traceability, and risk-based controls instead of ad hoc inspection.
For agentic systems, facet design also intersects with prompt injection, tool abuse, and trace provenance. The OWASP Agentic AI Top 10 is useful because it frames the kinds of failures that need to be visible in traces, not just blocked at runtime. In practice, many security teams discover facet design flaws only after an incident review has already failed to reconstruct what the agent actually did, rather than through intentional test coverage.
How It Works in Practice
Effective facet design starts with a single operational objective per facet. That objective might be “show all traces where the agent requested sensitive data,” or “group traces by escalation path.” Each label should be mutually exclusive, stable across reruns, and mapped to one workflow, such as triage, escalation, or approval. If a facet mixes intent, outcome, and severity in one dimension, it becomes difficult to trust.
A practical design process usually looks like this:
- Define the review question first, then choose only the trace fields needed to answer it.
- Prefer narrow slices that capture the smallest evidence set required for a decision.
- Separate deterministic facets from exploratory ones so operational dashboards do not drift.
- Test labels against repeated runs, reordered events, and partial traces to check stability.
- Document what the facet excludes, not just what it includes.
This is where provenance matters. If a facet is meant to identify risky retrieval, it should distinguish between user input, retrieved content, tool output, and model-generated text. That distinction supports both root cause analysis and control validation. The MITRE ATLAS adversarial AI threat matrix helps teams think about attacker behavior that may only appear as a trace pattern, while the Anthropic report on AI-orchestrated cyber espionage illustrates why execution trace clarity matters when an agent is being manipulated across steps.
Teams should also align facet definitions with control evidence. If a trace facet is meant to support governance review, it should map cleanly to approval records, policy exceptions, or tool invocation logs. These controls tend to break down when trace schemas are inconsistent across services because the same behavior is recorded with different field names, timestamps, or tool identifiers.
Common Variations and Edge Cases
Tighter facet design often increases analyst effort, requiring organisations to balance clean classification against schema maintenance and reviewer workload. That tradeoff is especially visible in multi-agent systems, where one action may be distributed across several traces and no single event contains the whole story.
Best practice is evolving for agentic telemetry, and there is no universal standard for every environment yet. For high-volume operations, teams often use a small set of production facets for routing and a broader set of investigative facets for deeper analysis. That split reduces noise without losing forensic detail. The CSA MAESTRO agentic AI threat modeling framework is helpful when deciding which trace elements belong in the operational view versus the investigation view.
Edge cases matter most when traces are incomplete, async, or heavily preprocessed. If sampling drops intermediate steps, a facet may look stable while still hiding the exact decision point that matters. If a platform normalizes tool outputs before logging, the facet may lose the evidence needed to confirm a policy violation. In those environments, the safest pattern is to design facets around verifiable state transitions and then validate them against raw event capture, not just the cleaned trace feed. That is where alignment with OWASP Top 10 for Agentic Applications 2026 and the NIST risk model becomes operationally useful rather than theoretical.
