C13
Layer 3 - Observability & Forensics
Agent-Native Observability and Semantic Tracing
Semantic tracing correlated with policy, ledger, and replay. The minimum surface is one trace_id per agent run linking the four evidence streams.
Why
- You need “why” telemetry, not just “what happened.”
- But storing raw chain-of-thought is risky. The right balance is structured semantic traces.
What
- A standard semantic event model that captures: intent summaries
- decision categories (tool choice class, risk band)
- links to policy decisions, ledger events, and replay trace IDs
- anomaly indicators and confidence proxies (without raw CoT)
How
- propagate trace IDs across agent, gateway, tools, memory
- emit semantic events at each boundary step
- build dashboards: tool mix, denial rates, anomaly rates, divergence between versions
Evidence
- trace completeness and correlation metrics
- anomaly detection precision/recall (from test suite)
- operational dashboards linked to run IDs
Failure modes
- logging raw sensitive prompts/reasoning
- unstructured logs that can’t be correlated
- lack of redaction and classification in telemetry
NIST AI RMF alignment
C13 maps to MEASURE. See the framework paper for the specific subcontrol mappings.
ISO/IEC alignment
C13 maps to ISO/IEC 27001. Typical evidence: see the Evidence section above.