A shared set of attributes for representing model calls, token usage, tool invocations, and related metadata in a portable trace format. They let different observability backends read the same AI execution data without custom schemas or one-off instrumentation.
What the conventions represent in practice
OpenTelemetry GenAI semantic conventions are a shared vocabulary for AI telemetry. They standardize how traces describe model calls, prompts, token counts, tool invocations, and related metadata, so observability systems can compare and correlate the same execution path without bespoke schemas or custom parsers.
That portability matters because AI systems often span frameworks, runtimes, gateways, and observability backends. A common attribute model reduces translation loss, makes traces easier to query across tools, and helps teams preserve a consistent picture of what the application asked the model to do and what it actually executed.
What gets represented in a GenAI trace
The conventions are designed to make AI activity legible at the event level. They typically distinguish the model interaction itself from surrounding steps such as prompt construction, token consumption, streamed output, retrieval calls, and tool execution. That separation lets teams see which part of the workflow drove cost, latency, or side effects.
In practice, the value comes from the attributes that make each span comparable across services. If one service records a model call and another records a tool invocation, the same naming and field structure lets a backend join them into one execution story rather than treating each vendor or library as a special case.
For AI operations, the useful detail is not just that something happened, but what kind of action it was, which model or tool handled it, and how much context or output passed through the call. That makes the conventions useful for both performance analysis and post-incident reconstruction.
Why standardization matters for observability
Without shared conventions, AI telemetry tends to fragment into incompatible custom fields, making dashboards and searches brittle. Standardized attributes lower the integration cost for instrumentation and give engineering and security teams a stable way to compare latency, token usage, and call patterns across systems.
The same normalization also improves downstream correlation. When traces, logs, and metrics share a common semantic layer, it becomes easier to group related model activity, identify repeated failure modes, and preserve an auditable path from user request to model response to follow-on action.
The LLM Observability Guide expands on how these conventions support tracing, redaction, sampling, and operational monitoring across AI applications.
Where governance and security teams care about them
These conventions are not only an engineering convenience. They also create the evidence layer needed to understand what an AI system disclosed, invoked, or attempted. In security-sensitive environments, that matters because model inputs, outputs, and tool calls can expose secrets, reveal unsafe instructions, or trigger actions that need later review.
Telemetry only helps if it is complete enough to answer operational questions after the fact. If a trace omits tool arguments, model identifiers, or execution context, the organisation may still know that an agent acted, but not what it saw, what it tried, or which downstream system it touched.
The AI Agent Observability, Audit and Incident Response Guide is a useful companion where GenAI telemetry is being used to support investigation, attribution, and response.
How practitioners use the conventions well
The strongest use case is disciplined instrumentation, not maximal collection. Teams should treat the semantic model as the contract for what must be emitted consistently, then decide separately how much prompt content, tool detail, or response text should be retained under their privacy, retention, and security rules.
GenAI tracing is most valuable when it is paired with a clear operational purpose: debugging latency, understanding token cost, validating tool behavior, or reconstructing an incident. If the telemetry is too sparse, it cannot support analysis; if it is too verbose, it can create unnecessary exposure and storage burden.
The Observability, telemetry and SRE for security teams guide is helpful for teams hardening telemetry pipelines while preserving useful evidence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST AI 600-1, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI 600-1 | GenAI Profile | Profiles GenAI governance and telemetry practices for managing model risk and execution evidence. |
| Recommendation — Align GenAI telemetry fields with the profile to support governance, testing, and incident review. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | GenAI semantic traces improve continuous monitoring of model and tool activity. |
| Recommendation — Use standardized GenAI telemetry to monitor model and tool behavior for anomalies. | ||
| NIST SP 800-53 Rev 5 | AU-3 — Content of Audit Records | Semantic conventions define the audit details needed to make AI execution records usable. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Portable trace attributes make AI activity easier to review and correlate across systems. | |
| IA-5 — Authenticator Management | Model and tool telemetry can expose credentialed actions and support lifecycle review. | |
| Recommendation — Record model calls and tool actions with enough detail to support audit review. Review GenAI traces for suspicious or high-impact execution patterns. Correlate GenAI traces with credential use to detect misuse and rotate exposed secrets. | ||
Related resources from NHI Mgmt Group
- Why do GenAI semantic conventions matter for agent and workflow observability?
- Should organisations use OpenTelemetry GenAI conventions, OpenInference, or both in mixed AI environments?
- What is the difference between semantic conventions and instrumentation code in OpenTelemetry?
- How should teams instrument GenAI applications when their framework already emits OpenTelemetry GenAI spans?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org