For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

How to do it

When an agent leaks a key or breaks something, you need to know what it ran and who started it. Turn on the agent's telemetry export, such as OpenTelemetry events in Claude Code, and send it to the team's log store. Command details are often off by default, so turn them on for tool calls. Set the export in managed settings, because some tools ignore it in repository files. Cloud agents keep their own session logs, so link each agent commit to its session log. Logs can hold secrets and personal data, so restrict who reads them. Delete them on the schedule from Keep logs for a fixed time. Ship them as Send logs off the machine as they are written says.

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

Shell example

export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com:4317
export OTEL_LOG_TOOL_DETAILS=1

JSON example

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel.example.com:4317",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}

How to check

Start a session that runs git status and asks to read .env. Within five minutes the log store shows both calls with the session, the user, the command and the denied read.

Sources

• Claude Code monitoring
• GitHub Docs, risks and mitigations for Copilot cloud agent

Related rules

• Keep logs for a fixed time in Operations
• Send logs off the machine as they are written in Operations