Agentic runtime telemetry is the live operational data that shows what an AI agent is doing during execution. It includes tool calls, data access, decision paths, and behavioral changes, giving security teams the evidence needed to detect misuse, enforce guardrails, and investigate unsafe actions.
Expanded Definition
Agentic runtime telemetry is the execution-time record of an AI agent’s behaviour: which tools it invoked, what data it touched, which branches it followed, and how its state changed as it completed tasks. In NHI security, it is the difference between trusting an agent’s output and being able to reconstruct how that output came to be.
Definitions vary across vendors on how much telemetry is “enough,” but the operational core is consistent: the data must be timely, attributable, and rich enough to support detection, policy enforcement, and forensic review. For that reason, it sits alongside controls described in the OWASP Top 10 for Agentic Applications 2026 and the NIST AI Risk Management Framework, where observability supports governance rather than replacing it.
The most common misapplication is treating application logs as sufficient telemetry, which occurs when teams capture only final prompts or outputs and miss intermediate tool actions, retrievals, and privilege changes.
Examples and Use Cases
Implementing agentic runtime telemetry rigorously often introduces storage and privacy overhead, requiring organisations to weigh incident reconstructability against the cost of collecting sensitive execution detail.
- An autonomous support agent queries a customer record, then opens a billing API. Telemetry shows the tool chain, the record identifiers accessed, and whether the second action stayed within policy.
- A coding agent receives a task, calls a repository tool, and modifies production configuration. Telemetry allows investigators to compare the decision path against approved change boundaries, similar to cases discussed in Analysis of Claude Code Security.
- An internal agent retrieves secrets from a vault and then attempts an outbound transfer. Runtime records make secret access visible, which is critical when assessing exposure patterns highlighted by Moltbook AI agent keys breach.
- A workflow agent changes behaviour after a prompt injection event. Telemetry helps security teams isolate the triggering input, the altered state, and the unsafe tool call sequence.
- A multi-agent system delegates tasks across services. Execution traces expose which agent assumed authority, which tokens were used, and where trust boundaries collapsed.
These use cases align with agentic-risk guidance in the OWASP Agentic AI Top 10 and the OWASP NHI Top 10, where action visibility is a prerequisite for safe delegation.
Why It Matters in NHI Security
Without runtime telemetry, agent activity becomes a black box, making it difficult to prove whether an action was authorised, accidental, or malicious. That gap is especially dangerous in NHI environments because agents often act through short-lived credentials, delegated tokens, and tool permissions that leave little evidence outside execution traces. NHIMG research shows the visibility problem is already widespread: only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
Telemetry also supports governance after compromise. When a secret is abused, a tool is coerced, or an agent begins acting beyond scope, the investigative question is rarely “what did the model say?” It is “what did the agent do, in what order, using which identity, and against which resources?” That is why observability belongs in zero trust and AI risk programs, as reflected in the NIST AI Risk Management Framework and the MITRE ATLAS adversarial AI threat matrix. Organisations typically encounter the need for agentic runtime telemetry only after an unsafe action, at which point reconstruction becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-08 | Covers logging and monitoring gaps for non-human identities and agent actions. |
| OWASP Agentic AI Top 10 | A-04 | Agentic observability is needed to detect unsafe tool use and hidden action paths. |
| NIST AI RMF | MAP/MEASURE | Telemetry supports mapping and measuring AI system behavior and risk in operation. |
| NIST Zero Trust (SP 800-207) | 3.1 | Zero trust requires continuous verification of actions, not just initial authentication. |
| CSA MAESTRO | MONITOR | MAESTRO emphasizes runtime monitoring for autonomous agent safety and governance. |
Capture tool calls, state changes, and policy decisions to detect and stop unsafe agent behavior.
Related resources from NHI Mgmt Group
- When should organisations treat runtime telemetry as a primary control?
- Why do agentic AI systems need runtime security instead of static guardrails alone?
- Why do agentic systems need both runtime controls and event governance?
- Why does MCP increase the importance of runtime authorisation for agentic AI?
