Log what every agent session does

How to do it

When an agent leaks a key or breaks something, you need to know what it ran and who started it. Turn on the agent's telemetry export, such as OpenTelemetry events in Claude Code, and send it to the team's log store. Command details are often off by default, so turn them on for tool calls. Set the export in managed settings, because some tools ignore it in repository files. Cloud agents keep their own session logs, so link each agent commit to its session log. Logs can hold secrets and personal data, so restrict who reads them and mask keys as Redact secrets from agent session logs says. Delete them on the schedule from Keep logs for a fixed time. Ship them as Send logs off the machine as they are written says.

Examples

Shell example

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com:4317
export OTEL_LOG_TOOL_DETAILS=1

JSON example

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel.example.com:4317",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}

How to check

Start a session that runs git status and asks to read .env. Within five minutes the log store shows both calls with the session, the user, the command and the denied read.

Sources

• Claude Code monitoring
• GitHub Docs, risks and mitigations for Copilot cloud agent

Related rules

• AID-76 Redact secrets from agent session logs in AI-assisted development
• OPS-10 Keep logs for a fixed time in Operations and observability
• OPS-11 Send logs off the machine as they are written in Operations and observability