Claude Code telemetry changes how teams govern AI coding agents

At a glance

What this is: This is a practitioner-focused analysis of monitoring Claude Code with OpenTelemetry, with the key finding that AI coding agents need durable telemetry, redaction, and approval logging to stay governable.

Why it matters: It matters because AI coding agents can touch code, data, and tools in ways that create audit, compliance, and privilege questions for both human and non-human identity programmes.

By the numbers:

• Only 5.7% of organisations have full visibility into their service accounts.
• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.

👉 Read Bindplane's analysis of monitoring Claude Code with OpenTelemetry

Context

AI coding agents are no longer just productivity tools. Once they can read prompts, call tools, and alter code or workflows, the governance problem becomes one of auditability, privilege, and evidence, not simply model quality or developer adoption. In practice, that makes Claude Code a non-human actor that should be observed with the same discipline used for other high-value machine identities.

Bindplane’s article is useful because it treats telemetry as a control surface rather than a logging afterthought. The underlying problem is common across agentic AI programmes: teams want speed, but they also need durable records of what the agent saw, what it did, and what was approved. That tension is familiar to IAM and PAM teams because agent actions can look like standing delegated access unless they are deliberately scoped and monitored.

The starting point in this article is typical of mature internal adopters, but atypical for organisations still rolling out AI coding agents without a governance model.

Key questions

Q: What fails when AI coding agents are not logged like privileged systems?

A: Teams lose the ability to reconstruct what the agent saw, what it changed, and whether a human approval was valid. That creates an evidence gap that weakens incident response, compliance review, and accountability when code or data changes appear suspicious after the fact.

Q: Why do AI systems create identity and access risk beyond traditional AppSec?

A: Because AI systems often act through delegated access. When a model can use tools, retrieve data, or trigger actions, it becomes a runtime decision-maker with privileges that can be misused through prompt injection, poisoned context, or overbroad permissions. That is an identity problem as much as a code problem.

Q: What do security teams get wrong about telemetry for AI agents?

A: They often treat telemetry as a troubleshooting tool instead of a governance control. For agentic systems, telemetry is also the record of what was requested, approved, and executed, so it must support audit, redaction, and investigation rather than just dashboarding.

Q: How should organisations govern tool approvals in AI coding workflows?

A: They should treat each approval as a privileged event with identity binding, context, and retention. That means recording who approved the action, what tool was used, where the action went, and whether the request matched policy before execution completed.

Technical breakdown

OpenTelemetry turns agent activity into governable evidence

Claude Code emits telemetry that can be collected, pre-processed, and routed like any other observability stream. The important shift is that prompts, responses, tool calls, and approval events become structured evidence, not disposable runtime noise. In an agentic AI context, that evidence supports incident response, compliance review, and behavioural investigation. Without it, teams are left inferring intent from code changes alone, which is a weak basis for governance when an agent may have evaluated multiple actions before acting.

Practical implication: instrument agent runtimes so tool approvals and outputs are retained in a form that supports later audit and investigation.

Redaction and filtering are part of AI data governance

The article shows a pipeline that redacts sensitive fields before one destination and filters spans before storage. That matters because AI telemetry often contains fragments of personal data, secrets, internal URLs, or prompts with business context. A useful telemetry architecture therefore separates full-fidelity audit data from day-to-day operational data and applies policy before egress. This is a classic data governance pattern, but it becomes more urgent when an agent can generate high-volume traces across many developer endpoints.

Practical implication: define which telemetry fields are retained, redacted, or dropped before they leave the endpoint or controlled pipeline.

Approved tool calls are the highest-risk control point

The article correctly identifies approved tool calls as the moment Claude Code can actually affect the environment. That is where least privilege, approval logic, and anomaly detection matter most, because the agent is moving from observation to action. In identity terms, this is a delegated execution problem: the tool call is the credentialed act, and the approval record is part of the governance trail. If those events are not logged with enough fidelity, security teams lose the ability to distinguish normal agent assistance from unsafe or malicious behaviour.

Practical implication: track every approved tool call with identity, context, and destination details so anomalous actions can be challenged or revoked.

Threat narrative

Attacker objective: The objective is to influence agent actions in a way that changes code, data, or operational state while reducing the organisation's ability to prove what happened.

1. Entry occurs when the AI coding agent is given access to prompts, tool interfaces, and local telemetry paths inside the developer workflow.
2. Escalation happens when approved tool calls allow the agent to take actions on the environment beyond passive generation, including code changes or data movement.
3. Impact follows if the agent is prompted, misled, or abused without durable telemetry, because investigators cannot reconstruct what the agent actually did.

NHI Mgmt Group analysis

AI coding agents are becoming governed execution surfaces, not just productivity tools. Once a model can read prompts, call tools, and influence code paths, the security question shifts from model output quality to runtime accountability. That is an identity problem as much as an AI problem, because the agent's approved actions become delegated acts that require traceable authority. Practitioners should treat agent telemetry as governance evidence, not optional observability.

Durable telemetry is the missing control plane for agentic AI. A prompt, a response, and a tool call only become governable when they can be retained, redacted, and correlated across time. This is the same failure pattern that appears in machine identity governance: when actions outpace visibility, teams cannot enforce review, investigate misuse, or prove appropriate access. Practitioners should design for evidence retention before broad rollout.

Agent approval logs create a new least-privilege boundary. The highest-risk moment is not when the model suggests an action, but when the environment accepts it. That means approval decisions, destination routing, and context binding are now control points for security and compliance teams. The governance gap is a delegated action blind spot, where organisations can see the agent but not reliably defend the act it was allowed to perform. Practitioners should align approvals with identity controls and audit retention.

AI governance debt will accumulate wherever observability is treated as an engineering choice instead of a control requirement. Organisations that deploy agents without standard telemetry, redaction, and policy-backed routing will eventually pay for that gap in incident response, compliance, or access review. The more agents are embedded into developer workflows, the more their runtime behaviour resembles a fleet of non-human identities. Practitioners should build governance into the deployment pattern, not retrofit it after adoption.

What this signals

Delegated action blind spots will become the default failure mode for agentic AI. As more coding agents gain access to toolchains, the practical question is not whether they are useful but whether their actions can be tied back to an accountable identity and a durable evidence trail. Teams should expect audit and compliance requirements to land on agent telemetry, approval records, and retention policy, not just on the model itself.

Agent telemetry will start to look like NHI telemetry. When an AI coding agent can act in the environment, organisations need the same disciplines they use for machine identities: scoping, logging, retention, and lifecycle control. The problem is not only observability volume. It is whether the telemetry proves that the agent stayed inside its intended boundary.

Runtime evidence will matter more than post hoc review. By the time a code change has propagated, the question is no longer what the model intended, but what it was allowed to do. That pushes security programmes toward policy-based collection, redaction before storage, and identity-aware approval workflows, especially where agent actions touch secrets, source code, or production-adjacent systems.

For practitioners

• Instrument agent runtimes with immutable approval logging Capture prompts, tool calls, responses, and approval events in a durable record that can be queried during incident response and audit. Keep the log separate from day-to-day operational dashboards so evidence survives normal pipeline tuning.
• Apply pre-ingest redaction to sensitive telemetry fields Remove or mask personal data, secrets, and internal identifiers before telemetry leaves the controlled pipeline. Use policy-based filtering for spans and logs so storage, analysis, and sharing all respect the same data handling rules.
• Treat approved tool calls as privileged actions Bind each approval to a user, device, context, and destination so the organisation can distinguish normal assistance from unsafe execution. Review these events like privileged access, because they are the point where the agent can change real systems.
• Separate operational analytics from forensic retention Keep short-lived usage metrics for adoption and cost analysis, but store a full-fidelity trace trail for investigations and compliance. That split lets teams manage spend without losing the evidence needed to reconstruct agent behaviour.

Key takeaways

• AI coding agents create a governance problem because approved tool calls are effectively privileged actions.
• Telemetry only becomes useful when it preserves evidence, redacts sensitive fields, and separates audit data from operational analytics.
• As agent adoption spreads, identity teams will need to govern delegated runtime behaviour with the same discipline they apply to other non-human identities.

Key terms

• Agent telemetry: Operational data describing what an AI agent did, which tools it called, how much it consumed, and what resources it touched. Telemetry is essential for audit, incident response, and behavioural governance because agent decisions are otherwise difficult to reconstruct.
• Delegated action: An action performed by one identity on behalf of another, with some authority borrowed from the principal. In agentic environments, delegated action needs explicit scope, auditability, and revocation boundaries because the executor is not the same as the beneficiary.
• Forensic Retention: The practice of keeping security-relevant records long enough and in enough detail to support later investigation, audit, or legal review. For agentic AI, this means preserving evidence of inputs, approvals, and outputs even after operational dashboards roll on.
• Tool Approval: A control decision that permits an AI agent to invoke a specific external capability, such as a shell command, API, or deployment action. It marks the boundary between suggestion and execution, which is why it should be logged, scoped, and reviewed like privileged access.

What's in the full article

Bindplane's full article covers the operational detail this post intentionally leaves for the source:

• The exact OpenTelemetry collection pattern used to ingest Claude Code telemetry from developer endpoints
• The settings.json configuration and routing logic used to push telemetry to multiple destinations
• The redaction and filtering steps applied before data reaches storage and dashboards
• The practical split between operational metrics, full-fidelity audit traces, and developer experience analytics

👉 The full Bindplane article covers the telemetry pipeline, redaction logic, and destination routing details

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to modern automation and AI-driven workflows.