Keep the fields that answer an operational question, such as tool success, token usage, latency, errors and approval decisions. Drop prompts, full responses, large tool outputs and other content that only adds storage cost. If a field is needed for correlation but not for reading, hash it instead of storing it raw.
What telemetry should earn its place?
Keep telemetry that answers an operational or security question quickly. For AI agents, that usually means tool invocation success or failure, latency, token usage, approval decisions, error codes, correlation identifiers and enough context to reconstruct what happened without replaying the whole interaction. The test is simple: if the field helps you detect misuse, diagnose failures, or prove control operation, it belongs.
That approach matches how teams instrument agent activity for attribution and response, including the logging and correlation patterns described in AI Agent Observability, Audit and Incident Response Guide. It also aligns with Zero Trust for AI Agents, where per-action verification matters more than broad trust in the session.
If the field is needed to answer “did the agent do the right thing, and who approved it?” keep it. If it only helps someone read the full conversation later, it is usually a poor retention candidate.
What should be dropped or reduced?
Drop prompts, full responses, large tool outputs and other content that mainly increases storage cost or exposure surface. Those artefacts are often useful during development, but in production they can capture secrets, customer data, proprietary content or irrelevant noise that makes search, retention and review harder.
When you do not need the raw value for human reading, reduce it. Hashing, tokenisation or structured summaries can preserve correlation and audit value without keeping the original payload in clear text. That is especially useful when multiple logs need to be joined but the field itself is not operationally meaningful.
This is also where agent-side content can become a security liability rather than just a storage problem, which is why the AI Coding Agents Security Guide emphasises secrets in context and the blast radius of over-scoped material. For broader agent risk patterns, the Agentic AI Security Guide is useful because it frames logging, tools and identity as part of the same control surface.
How should teams decide what to keep at all?
Use a purpose-based filter. Keep a field only if it supports one of four jobs: detection, investigation, accountability, or performance tuning. If it does none of those jobs, or if the same job can be done with a smaller surrogate such as a hash, status flag or reference ID, drop the raw content.
That rule becomes more important as agents gain broader tool access. The more a record can reveal about user intent, system state or downstream data, the more carefully it should be treated. A useful telemetry design keeps enough signal to reconstruct agent behaviour while avoiding a second copy of the original interaction stream.
For teams formalising this boundary, the AI Agent Authorisation Guide and the AI Agent Observability, Audit and Incident Response Guide work well together: the first defines what the agent may do, while the second defines what must be observable after it acts.
Risk and Threat Considerations
Over-retained telemetry widens the blast radius of an agent compromise because it can expose prompts, secrets, customer data, internal reasoning and sensitive tool outputs in one place. It also creates a quieter failure mode: teams keep more than they can review, so the logs become a liability instead of an investigative asset.
Failure mechanism: The agent’s logs become a shadow data store. If access control, redaction or retention are weak, an attacker or insider can mine that store for credentials, data extracts, approval paths or high-value context that the agent handled during normal work.
Impact: Exposure can extend beyond the original incident, because the retained telemetry may reveal how to replay, escalate or broaden the compromise. It can also increase compliance and discovery burden, and make incident response slower by burying the useful signals inside low-value content.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-3 — Content of Audit Records | Telemetry design hinges on recording only meaningful audit content. |
| AU-11 — Audit Record Retention | The question is fundamentally about what to retain versus drop from telemetry. | |
| IA-5 — Authenticator Management | Hashing or redacting sensitive fields helps avoid retaining reusable authentication material. | |
| Recommendation — Record only the event details needed to support investigation and accountability. Set retention rules that discard low-value telemetry and preserve required audit evidence. Protect and rotate sensitive values, and avoid storing raw secrets in telemetry. | ||
| NIST CSF 2.0 | PR.AA-04 — Identity Management, Authentication, and Access Control | Agent telemetry decisions affect what identity and access evidence is preserved for verification. |
| DE.CM-01 — Anomalies and Events are Detected | Useful telemetry must support detection of abnormal agent behaviour and misuse. | |
| Recommendation — Keep only the access evidence needed to verify agent actions and remove unnecessary raw content. Preserve the signals needed to detect anomalous agent actions and failures. | ||
Practitioner Guidance
What to prioritise: Build telemetry around decisions, state changes and control points, not around full conversation replay. If a field is not needed for detection, accountability or investigation, treat it as a deletion candidate by default.
What to verify: Confirm that every retained field has an owner, a purpose and a retention period. If you cannot explain why a field must stay raw, it should usually be reduced, hashed or removed.
Common mistake: Teams often preserve raw prompts and outputs “just in case” and then discover they have created a high-risk archive that is harder to secure than the production system the agent controls.
Practitioner takeaway: Keep telemetry that helps you prove and investigate agent behaviour, and discard everything else as soon as it stops carrying operational value.
Related resources from NHI Mgmt Group
- Why is single-provider AI agent governance not enough for enterprise security?
- How should security teams handle risks from AI browser extensions?
- How should security teams govern API keys used for generative AI access?
- How do security teams decide whether an AI agent should keep access to regulated data?