---
title: "Log what every agent session does · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/agent-activity-log
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Log what every agent session does

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- Level: Recommended
- Chapter: [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)
- Rule: Record every command, tool call and approval an agent makes, with its session and the person who started it. Keep the log off the developer's machine.
- How: When an agent leaks a key or breaks something, you need to know what it ran and who started it. Turn on the agent's telemetry export, such as OpenTelemetry events in Claude Code, and send it to the team's log store. Command details are often off by default, so turn them on for tool calls. Set the export in managed settings, because some tools ignore it in repository files. Cloud agents keep their own session logs, so link each agent commit to its session log. Logs can hold secrets and personal data, so restrict who reads them. Delete them on the schedule from [Keep logs for a fixed time](https://agentwranglers.se/playbook/operations/logs/log-retention). Ship them as [Send logs off the machine as they are written](https://agentwranglers.se/playbook/operations/logs/off-host-logs) says.
- Check: Start a session that runs `git status` and asks to read `.env`. Within five minutes the log store shows both calls with the session, the user, the command and the denied read.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```bash
export CLAUDE_CODE_ENABLE_TELEMETRY=1
export OTEL_LOGS_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_ENDPOINT=https://otel.example.com:4317
export OTEL_LOG_TOOL_DETAILS=1
```

### JSON example

```json
{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel.example.com:4317",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}
```

## Sources

- [Claude Code monitoring](https://code.claude.com/docs/en/monitoring-usage)
- [GitHub Docs, risks and mitigations for Copilot cloud agent](https://docs.github.com/en/copilot/concepts/agents/coding-agent/risks-and-mitigations)

## Related rules

- [Keep logs for a fixed time](https://agentwranglers.se/playbook/operations/logs/log-retention) in Operations
- [Send logs off the machine as they are written](https://agentwranglers.se/playbook/operations/logs/off-host-logs) in Operations

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/agent-activity-log">Agent Wranglers AI development playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Enforce the team's agent settings centrally](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions/managed-agent-settings)
- [Safety and permissions](https://agentwranglers.se/playbook/ai-assisted-development/safety-and-permissions)