Cloudflare agent tracing clarifies production evaluation for IAM teams

At a glance

What this is: Braintrust's Cloudflare integration adds native tracing for Cloudflare Agents so production agent behaviour can be captured as structured spans and reused for evaluation.

Why it matters: This matters because agent tracing creates an audit trail for how AI systems use tools, call models, and make decisions, which is essential for controlling delegated access and reviewing agent behaviour in IAM-linked environments.

👉 Read Braintrust's guide to tracing Cloudflare Agents in production

Context

Agent tracing is the capture of runtime events from an AI system so teams can inspect what it did, what tools it used, and how it reached a result. In this case, the governance gap is familiar to identity teams: delegated systems often operate with more capability than operators can easily reconstruct after the fact, especially when agents sit between users, tools, and infrastructure.

Cloudflare Agents produce OpenTelemetry spans that Braintrust can ingest, which means the trace becomes a shared record of model calls, tool calls, approvals, and subagent activity. That is relevant to IAM and NHI governance because agent behaviour is increasingly shaped by credentials, runtime permissions, and tool access, not just prompts. The strongest starting point is to treat agent traces as evidence for control review, not just as debugging telemetry.

Key questions

Q: How should security teams govern AI-enabled workflows that can act on their own?

A: Treat them as identity-governed execution paths, not just software features. Assign a named owner, define least-privilege access, log every tool call, and require revocation paths for credentials and tokens. If the workflow can touch production systems or sensitive data, its permissions must be reviewed with the same discipline used for privileged machine identities.

Q: Why do AI agents make non-human identity governance harder?

A: AI agents make governance harder because they can request tools, act autonomously, and change behaviour across sessions while still relying on machine credentials. That increases the number of access paths security teams must supervise. The result is a stronger need for task-scoped access, explicit ownership, and continuous monitoring of what the agent can reach.

Q: How do teams know whether agent traces are actually useful for control review?

A: Useful traces show the full decision path, not just the final response. If you can trace a failure back to a specific tool call, approval step, or dependency, the data is usable for control review. If the trace only shows outputs, it is debugging data, not governance evidence.

Q: What should organisations do when tracing secrets are used in AI workloads?

A: Manage tracing keys like sensitive operational credentials. Restrict who can create or read them, store them in approved secret management, and rotate them on a defined schedule. If the tracing layer is compromised, attackers can tamper with visibility, exfiltrate telemetry, or weaken review of agent behaviour.

Technical breakdown

OpenTelemetry tracing for Cloudflare agents

Cloudflare Agents emit OpenTelemetry spans, and Braintrust can receive those spans through an OTLP destination or in-process JavaScript instrumentation. The technical value is that the trace is not limited to model output. It includes the sequence of agent invocations, tool calls, approvals, subagent activity, token usage, and the surrounding Workers infrastructure. That creates a single event stream that can be exported, queried, and evaluated over time. For practitioners, the important point is that the trace becomes a structured record of runtime behaviour rather than an opaque log blob.

Practical implication: route agent spans into a controlled destination so behaviour can be reviewed against access and approval policy.

Why production traces become evaluation datasets

Production traces matter because they capture what the agent actually did in real conditions, not what it was expected to do in a test harness. Braintrust describes a workflow where traces later become eval datasets, allowing teams to compare models, compare subagents, and measure whether a prompt or tool change improved outcomes before redeploying. This is an operational feedback loop, not just observability. In identity terms, it is the difference between assuming delegated behaviour is safe and measuring whether the delegated path stayed within its intended authority boundary.

Practical implication: use production traces to validate whether agent behaviour stayed within the permissions and workflow boundaries you intended.

Workers-runtime instrumentation and credential handling

The integration supports two tracing paths. Teams can export traces via OpenTelemetry, or instrument directly inside the Worker using the Braintrust JavaScript SDK. The setup still depends on operational controls such as nodejs_compat, a stored BRAINTRUST_API_KEY, and flushing buffered traces after the response returns. That means trace integrity is partly a secrets-management and runtime-governance problem. If the instrumentation secret is mishandled, the observability layer itself becomes another identity asset that needs protection.

Practical implication: manage tracing keys like any other sensitive runtime secret and include them in secret rotation and access review.

NHI Mgmt Group analysis

Agent tracing is becoming a governance control, not just an observability feature. Once AI systems can take tool actions in production, teams need evidence of what was invoked, approved, and returned. That evidence supports incident review, policy validation, and model change control. In practice, tracing should sit alongside access governance, not outside it.

Cloudflare agent activity exposes a classic identity problem in a new form: delegated runtime authority. The issue is not only whether an agent can call a tool, but whether that call is attributable, reviewable, and bounded by least privilege. That makes the trace a control record for NHI-style runtime access, especially where agents operate with API keys, service credentials, or workflow permissions.

Trace data can sharpen the boundary between debugging and governance. Structured spans help teams distinguish a model error from a bad tool call, a slow dependency, or an overbroad permission path. That matters because many AI incidents are treated as quality failures when they are actually authorisation failures. Practitioners should use traces to expose where runtime access exceeded design intent.

Agent observability creates a new concept worth tracking: delegated decision accountability. When an agent can choose actions, tools, and timing, the organisation must be able to explain those choices after the fact. That requires durable traces, retained approvals, and clear ownership for the credentials behind the agent. The control question is no longer whether the agent ran, but whether the run can be governed.

This integration signals that AI runtime governance is converging with identity and access management discipline. As more agent frameworks standardise tracing, the market will increasingly expect auditability, reproducibility, and policy evidence as baseline requirements. For practitioners, the next step is to decide which agent traces become control evidence and how long they must be retained.

What this signals

As agent tracing matures, security teams will need to decide which runtime events become control evidence and which remain engineering telemetry. That distinction will matter for audit retention, incident investigation, and policy validation across AI-driven workflows.

Delegated decision accountability: the operational question is no longer whether an agent can take actions, but whether the organisation can reconstruct and justify those actions later. Teams that cannot link traces to identity, approval, and permission boundaries will struggle to govern agentic systems at scale.

For practitioners

• Treat agent traces as governance evidence Define which agent spans must be retained for review, including model calls, tool calls, approvals, and subagent activity. Map those events to control owners so trace review supports incident triage, policy testing, and access decisions.
• Protect tracing credentials like production secrets Store the BRAINTRUST_API_KEY in a restricted secret store, scope access to deployment automation only, and rotate it on the same schedule as other runtime credentials used by the Worker.
• Separate evaluation data from live execution paths Use traces to build eval datasets after execution rather than feeding live decisions back into production without review. That reduces the chance that debugging telemetry becomes an uncontrolled decision loop.
• Map traced tool calls to authorisation boundaries Review every traced tool call against the permissions the agent was intended to hold, then flag any call that depended on broader access than the workflow justified. This is especially important for agents using service credentials or API keys.

Key takeaways

• Agent tracing turns AI runtime behaviour into evidence that identity and security teams can govern.
• Structured traces help separate model errors from tool misuse, approval gaps, and permission drift.
• Tracing is only useful when its credentials, retention, and review model are controlled like other production identities.

Key terms

• Delegated decision authority: Delegated decision authority is the transfer of a bounded operational decision from a human to a system. For AI security operations, it marks the point where automation is no longer just executing rules, but influencing which incidents matter and what response should happen next.
• Agent Trace: A structured record of an AI agent’s runtime activity, including model calls, tool calls, approvals, and subagent steps. In practice, traces support debugging, evaluation, and governance when they are retained, searchable, and tied to the permissions behind the agent.
• Runtime authority: Runtime authority is the permission an AI system has while it is actively deciding and acting, not just when it is approved. In governance terms, it is the point where access, tool use, and action scope become operational, which is why build-time review alone cannot prove safety.

What's in the full article

Braintrust's full post covers the operational detail this post intentionally leaves for the source:

• Step-by-step OpenTelemetry setup for routing Cloudflare Agent spans into Braintrust without a Worker SDK
• JavaScript instrumentation patterns for Cloudflare Agents SDK, @cloudflare/ai-chat, @cloudflare/think, and Flue
• Worker deployment requirements including nodejs_compat, secret handling, and trace flushing
• How traced production runs become eval datasets for comparing models, prompts, and subagents

👉 The full Braintrust post covers Cloudflare setup, instrumentation patterns, and evaluation workflows.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect runtime access, delegated authority, and identity controls across modern security programmes.