Topic starter
18/08/2026 2:52 pm
TL;DR: Per-session cost, token counts, prompts, tool calls, and session metrics are already available from Claude Code through OpenTelemetry, according to Bindplane. Aggregate-only views leave governance decisions blind to session-level activity and the telemetry that can carry sensitive operational detail.
Editorial analysis by NHI Mgmt Group, based on content published by Bindplane: “Claude Code + OpenTelemetry: Per-Session Cost and Token Tracking”.
Key questions
Q: Why do per-session tool events create governance risk in AI coding workflows?
A: Because tool events can include commands, file paths, and other operational details that were never meant to leave the developer environment untouched.
Q: How should teams govern prompt and tool telemetry from AI coding assistants?
A: Treat it like production telemetry with security sensitivity.
Q: What breaks when AI coding telemetry is only visible in aggregate dashboards?
A: Teams lose the ability to attribute usage, audit tool activity, and spot sensitive data flowing through prompts or tool results.
Practitioner guidance
- Define telemetry collection boundaries for AI coding tools Specify which Claude Code metrics and logs are permitted, which fields must be redacted, and which destinations are approved before enabling export.
- Route tool-result data through a redaction step Inspect claude_code.tool_result fields for commands, file paths, and secret-adjacent values, then remove or mask them before they reach shared observability systems.
- Manage exporter settings centrally Use an administrator-managed configuration so telemetry endpoints, protocols, and export flags are enforced consistently across developer machines.
Bottom line: Claude Code telemetry exposes a gap between what is available for governance and what most teams actually inspect, because aggregate dashboards do not show session-level activity.
Glossary terms: Telemetry pipeline, Session-level telemetry, Observability Redaction, Administrator-Managed Settings File
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 12 hours ago by NHI Mgmt Group
18/08/2026 3:36 pm
AI coding telemetry is becoming part of the control surface: once prompts, tool results, and session metrics exist in the same pipeline as infrastructure and application telemetry, the governance question shifts from collection to stewardship. Teams must decide whether that data is operational observability, regulated development evidence, or both. The correct answer is usually all three, which means policy has to exist before rollout, not after a developer turns it on.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What should security teams do before turning on AI coding telemetry org-wide?
A: Start with a pilot, verify the exact records being emitted, and confirm that redaction and routing behave as intended. Then decide whether prompt content should remain disabled, since even apparently routine telemetry can contain operational context. Enterprise rollout should follow validation, not precede it.
👉 Read our full editorial: Claude Code telemetry exposes per-session AI usage and tool activity
This post was modified 12 hours ago by NHI Mgmt Group