Coding agent observability: are your controls keeping up?

TL;DR: Coding agents can loop, lose context, and misuse tools without throwing errors, so request-level monitoring misses the failure modes that matter, according to Fiddler. Observability has to capture session traces, behavioural signals, and cost attribution before teams can safely grant more autonomy than they can oversee.

NHIMG editorial — based on content published by Fiddler: Coding Agent Observability: How to Observe What Your Agents Actually Do

By the numbers:

• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.

Questions worth separating out

Q: How should security teams govern coding agents that already have access to production tools?

A: They should govern the agent as a delegated identity, not as a piece of software.

Q: Why do coding agents need more than request logging and CI status checks?

A: Because request logging only proves that a task completed, not that the generated code was correct or safe.

Q: What breaks when a coding agent loses context during a long session?

A: The agent can start optimising for the wrong goal, repeat tool calls, or produce code that fits the local test but violates the broader requirement.

Practitioner guidance

• Instrument full agent-session traces Enable end-to-end tracing for every model call, tool invocation, and sub-agent handoff, then preserve the full session timeline for review and replay.
• Correlate intent with tool activity Join agent-side spans with gateway-side and MCP-side logs under a shared session identifier so you can see both what the agent planned and what data actually flowed through the session.
• Set loop and context thresholds Define alert thresholds for excessive step counts, repeated tool-call failures, and context-window utilisation near exhaustion.

What's in the full article

Fiddler's full blog covers the operational detail this post intentionally leaves for the source:

• Agent-side OpenTelemetry export settings and span attributes for coding agents
• Gateway-side and MCP-side capture patterns for correlating tool responses with agent intent
• Example alert thresholds for loop counts, token overuse, and context-window overflow
• Implementation guidance for preserving complex span attributes without truncation

👉 Read Fiddler's analysis of coding agent observability and control →

Coding agent observability: are your controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →