Cloudflare agent tracing clarifies production evaluation for IAM teams

At a glance

What this is: Braintrust outlines native tracing for Cloudflare Agents that turns production agent activity into structured traces across model calls, tools, approvals, and runtime context.

Why it matters: This matters because IAM and AI governance teams need evidence of what an agent did, what it touched, and how decisions were made before they can treat agent behaviour as controllable in production.

Context

Agent tracing is the practice of recording an agent's runtime steps as structured telemetry rather than relying on logs or post hoc summaries. In production, that matters because agent behaviour spans model calls, tool use, approvals, and infrastructure context, which makes it hard to reconstruct failures or governance decisions from a single system of record.

For IAM and AI governance teams, the real question is whether traces can support decision evidence, access review, and incident reconstruction across the agent lifecycle. That intersection is genuine here because the article ties agent runs to approvals, tool calls, and deployed infrastructure, which are all control points in production governance.

Braintrust's article frames this as a Cloudflare integration problem, but the broader issue is familiar across agentic systems: observability only becomes governance when it is durable, queryable, and tied to the controls that shape access and action. That is typical of teams moving from experimentation to production oversight.

Key questions

Q: What breaks when agent runs are not traced in production?

A: When agent runs are not traced, teams lose the ability to reconstruct which model call, tool invocation, or approval led to a bad outcome. That makes incident review slow and speculative. The practical gap is not just observability, but evidentiary continuity across the full decision chain.

Q: Why do production traces matter for governance in agentic systems?

A: Production traces matter because they turn agent behaviour into evidence. If approvals, tool use, and infrastructure context are captured together, security and IAM teams can evaluate whether an agent acted within its authority and whether the control design matched real-world behaviour.

Q: How do teams know whether agent handoff tracing is actually working in production?

A: Look for explicit evidence at the boundary. Useful signals include non-empty context transfer records, inherited guardrail counts, dropped metadata fields, and trace IDs that flow through each child span. If those signals are missing, tracing is too shallow to support root cause analysis, auditability, or reliable quality monitoring across the pipeline.

Q: Should organisations treat agent traces as audit evidence or just telemetry?

A: Organisations should treat agent traces as audit evidence when those traces are tied to approvals, access decisions, or customer-facing actions. Telemetry alone is not enough. Evidence becomes useful only when it can prove what happened, who or what acted, and under what authority.

Technical breakdown

How OpenTelemetry turns agent runs into governed traces

OpenTelemetry is a telemetry standard that records spans for discrete work units across distributed systems. Here, Cloudflare Agents emit spans for agent invocations, model calls, tool calls, approvals, and subagent activity, which Braintrust maps into structured traces. That matters because the trace becomes a single timeline for behaviour that would otherwise be scattered across model providers, runtime logs, and tool systems. When the Worker emits traces directly or routes them through OTLP, production behaviour can be evaluated without adding a separate logging plane.

Practical implication: Treat telemetry design as part of the control plane, not just observability plumbing, so agent actions remain attributable after deployment.

Why approvals and tool calls matter more than token counts

Token usage is useful, but it is not the governance signal that tells you whether an agent acted within scope. The article's stronger point is that approvals, tool calls, and subagent activity can be inspected together, which lets teams see whether a model was merely verbose or actually exercised risky authority. For production governance, the unit of concern is not the prompt alone but the sequence of actions that led to an external side effect, especially when the agent operates inside cloud infrastructure.

Practical implication: Separate behavioural review from usage metrics and focus governance on action sequences that show authority being exercised.

How production traces become evaluation datasets

A trace only becomes useful for improvement when it can be reused as evaluation data. Braintrust describes using the same production traces to compare models, test prompt changes, assess tool changes, and verify whether an agent improved before deployment. That creates a feedback loop between runtime evidence and offline evaluation, which is particularly relevant when agent decisions affect access, workflow integrity, or customer-visible outcomes. The architectural idea is simple: production evidence becomes the training set for safer release decisions.

Practical implication: Build a trace-to-eval pipeline so production evidence informs release gates rather than remaining a passive record.

Threat narrative

Attacker objective: The objective in this risk pattern is not an external intruder's persistence, but governance failure, where an agent's actions cannot be reconstructed or challenged after the fact.

1. Entry occurs when an agent runs in production and gains access to tools, data sources, and infrastructure context needed to complete tasks.
2. Credential or authority exposure happens through approvals and tool permissions that the trace can reveal, showing what the agent was allowed to invoke.
3. Impact emerges when a wrong model choice, bad tool call, or slow backend query produces an incorrect outcome that must be traced back for correction.

Breaches seen in the wild

• Okta support system breach 2023: A support service account credential saved in a personal Google profile let attackers take HAR files and hijack five Okta customers' sessions.
• Verkada camera breach 2021: Admin credentials on Verkada's exposed Jenkins support server let hackers into a support interface and customer cameras at 97 customers.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Agent traces are becoming a governance record, not just observability data. Once model calls, tool use, approvals, and infrastructure context sit in one timeline, the trace can support review, accountability, and incident reconstruction. That changes the status of telemetry from operational convenience to evidence. Teams should treat trace retention and queryability as part of the control design.

Behavioral evidence is the missing control surface for agentic systems. Traditional access review and logging assume actions can be mapped to stable users or well-bounded sessions. Agent runs are more fluid, but traces make that fluidity inspectable. The practical lesson is that governance has to move from static identity records toward runtime action evidence.

Production evaluation and access governance are converging. The same trace that helps compare prompts or models can also show whether an agent exceeded the authority it was given. That creates a direct link between quality engineering and IAM oversight, especially where approvals or tool calls act as a delegated privilege boundary. Practitioners should align evaluation pipelines with access policy review.

Traceability debt: the inability to reconstruct agent intent, authority, and side effects from production evidence. This article shows why that debt accumulates quickly when agents touch multiple tools and subagents in the same workflow. Once the control surface is opaque, teams cannot tell whether the failure was model quality, tool misuse, or an authorization problem. Practitioners should reduce that debt before agents scale further.

Cloudflare-style agent tracing strengthens the case for runtime governance in agentic AI. The point is not more logs, but better evidence for decisions that already carry operational and access consequences. That aligns most closely with identity governance when agent approvals and tool calls become auditable artefacts. Teams should use traces to prove who or what acted, and under what authority.

What this signals

Traceability debt: as agent deployments spread, the cost of not capturing runtime evidence compounds faster than many teams expect. Without durable traces, governance shifts from proving what happened to guessing after the fact.

For IAM and AI security programmes, the key design decision is whether agent telemetry is retained as operational noise or promoted into an auditable record of approvals, tool use, and delegated action. That choice determines whether production oversight is real or merely aspirational.

For practitioners

• Instrument agents for traceable approvals Capture approvals, tool invocations, and subagent steps as structured spans so each externally meaningful action can be reviewed after execution.
• Store production traces as evaluation inputs Keep representative traces from live workloads and reuse them to compare models, prompts, and tool changes before broader rollout.
• Separate behavioural evidence from usage metrics Review the sequence of actions, not just token counts or latency, when deciding whether an agent stayed inside its authority boundary.
• Bind trace retention to governance requirements Define retention, access, and review expectations for agent traces so they can support incident reconstruction and policy evidence when needed.
• Use runtime evidence in access reviews When an agent can invoke tools on behalf of a workflow, include its traces in the review of what was actually executed versus what was intended.

Key takeaways

• Agent tracing becomes materially useful when it records the sequence of model calls, tool use, approvals, and infrastructure context in one place.
• The governance value is not visibility for its own sake, but the ability to reconstruct actions, evaluate behaviour, and review authority boundaries after deployment.
• Teams should design traces as evidence-bearing records so production incidents, quality regressions, and access decisions can all be analysed from the same runtime data.

Key terms

• Agent Trace: A structured record of an AI agent’s runtime activity, including model calls, tool calls, approvals, and subagent steps. In practice, traces support debugging, evaluation, and governance when they are retained, searchable, and tied to the permissions behind the agent.
• Production Evaluations: Production evaluations are checks run on live or near-live agent behavior to confirm that output quality, policy compliance, and task success hold under real conditions. They are used when offline tests are not sufficient because agents can behave differently across inputs, tools, and runtime states.
• Tool Call Event: A discrete record that captures a single agent-initiated action against a tool or server. In practice it is the atomic unit of agent accountability, linking the actor, the request, the policy decision, and the result in a way that can be searched and verified later.
• Approval Boundaries: The policy limits that define which access requests can be approved automatically and which require human review. Strong approval boundaries prevent workflow tools from turning convenience into excessive entitlements or uncontrolled app adoption.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.