I connect the operating AI system to the authority, release, evaluation and recovery records an oversight team needs. This guide explains where OpenTelemetry helps, where additional controls and evidence are necessary, and why a trace is not a verdict.
Scroll for the complete guide. Detailed research exports and other sector/lab collections remain available only by arrangement: red@davisaigov.ai.
The additions adapt sections 8.5 and 8.6 of the supplied GenAI Span Security Map v5. Registration establishes what is approved; response and closure verify what remains. Neither step turns every normal task into an incident or requires retiring an agent after each successful run.
Establish the approved release, accountable agent identity and evaluation evidence before accepting work. Registration is a prerequisite; changes trigger reassessment, not blind trust in an unchanged name.
Evidence: Require manifest digest and verified signer, approved use and impact assessment, evaluation suite/results, responsible owner and activation decision. A signature proves neither safety nor certification.
Explore step 0Treat external content as untrusted data. The orchestrator starts with an approved objective, identity, scope, budget and stopping conditions.
Evidence: Capture input provenance, task identity and the approved operating envelope.
Explore step 1Retrieval and memory are distinct inputs. Both remain scoped to the task and principal; neither becomes an independent authority to act.
Evidence: Log source IDs, access decisions, memory reads or writes, versions and the common task trace. Capture happens now, not at the final reporting phase.
Explore step 2The model proposes; the orchestrator decides what happens next. A model output does not confer permission to execute.
Evidence: Retain template and model versions, input lineage and the proposal outcome without unnecessary sensitive payloads.
Explore step 3Before AI acts, a separate control checks permission. Work inside approved limits may proceed; restricted work waits for a named reviewer; prohibited work is blocked. The agent cannot approve itself, and a pending review is not permission to proceed.
Evidence: Keep the request, the rule applied, the allow or deny decision, any required human review and any approved exception. Check the result against the permission given.
Explore step 4An allowed decision reaches the dispatcher, then the permitted environment. The result returns to the orchestrator for validation, stop or bounded re-plan.
Evidence: Record tool identity, authorization reference, affected target, outcome, persistence and stop reason.
Explore step 5Material runtime components emit evidence throughout steps 1-5. This stage examines collection, cross-source correlation, evaluation and loss monitoring; it does not wait until task completion to start monitoring.
Evidence: Verify producer coverage, capture policy, sampling limitations and independent action records. Continue to step 7 for the conditional response and retirement lifecycle. The separate SIEM and RAG labs remain restricted.
Explore step 6On a material warning, use independent authority to stop or contain work, verify recovery and assess notice or review duties. Retire agents and grants when their approved use ends; not every completed task requires an incident response.
Evidence: Correlate the response decision, credential revocation, observed stop state, recovery test, notice assessment, recourse outcome and retirement record. Regulatory reporting clocks are fact- and jurisdiction-specific.
Explore step 7Component identifiers continue the existing ecosystem numbering. They are not additional OpenTelemetry standard operations or a claim that these controls are missing from every framework.
Maintains an accountable principal for each agent, its human owner and the chain of delegated authority. Child agents receive an intersected scope with explicit expiry, destination and shared budget limits; they do not inherit an unrestricted copy of the parent's permissions.
Control: Bind task and delegation IDs to authenticated workloads. Validate every hop, reject scope expansion, enforce expiry at the destination and propagate revocation to running children.
Reported evidence: Trusted identity service and delegation-registry issuance, delegation and revocation records.
practical_trust.delegation.chain_id; practical_trust.delegation.scope; practical_trust.delegation.expires_at
Client-written agent IDs or trace headers cannot substitute for an authenticated principal.
Links pre-release tests, canaries and continuing quality evaluations to the exact agent configuration, model snapshot and evaluation suite. Configuration stability and satisfactory answer quality are different questions.
Control: Use approved, use-case-specific test data and thresholds; record suite, dataset, evaluator and configuration versions. Route failed evaluations to an independent release or operating decision; retain coverage and uncertainty.
Reported evidence: gen_ai.evaluation.result can carry evaluation name, score/label and response linkage under the Development convention.
practical_trust.eval.suite_version; practical_trust.eval.model_ref; practical_trust.eval.dataset_version
Do not claim evaluations are absent from OpenTelemetry. Custom fields supply release and test-suite context beyond the chosen convention.
Gives a designated human the relevant evidence, consequence class, available alternatives and an independent approve, reject or interrupt path. Oversight is an operating function, not a decorative approval badge.
Control: Bind approval to one action, target, policy version and expiry. Separate the approver from the agent; test halt requests through the execution and identity layers and verify downstream effects.
Reported evidence: Independent human review, interrupt and drill records tied to the affected task and action.
practical_trust.oversight.decide; practical_trust.approver.reference; practical_trust.oversight.evidence_id
Not every action requires a person. Consequence thresholds and lawful review duties must be defined for the actual use case.
Registers the agent build, model reference, tool and extension set, prompt templates, policies and retrieval manifests before use. It connects approved releases and impact assessments to runtime inventory.
Control: Verify signatures and artifact digests against trusted release records; bind publisher identity, evaluation results and approvals. Resolve opaque provider model versions through available deployment evidence and flag missing proof.
Reported evidence: Release-manifest registration and trusted verifier results.
practical_trust.registry.register; practical_trust.manifest.digest; practical_trust.attestation.verifier; practical_trust.release.status
Digest equality does not prove origin or safety. Attestation here is not a certification of legal compliance.
Treats calls, tokens, elapsed time, provisioned resources and spending as bounded authority. The task budget is shared across retries and child agents rather than reset at each handoff.
Control: Reserve and reconcile consumption at the gateway or dispatcher using an independent ledger. Enforce limits before new work; handle concurrent reservations, idempotency and exhausted-budget states.
Reported evidence: Gateway/dispatcher measurements and independently enforced task-family reservations.
practical_trust.budget.reserve; practical_trust.budget.limit; practical_trust.budget.consumed; practical_trust.budget.unit
Token counts are not total spend. Observe only approved metric dimensions and avoid customer-level cardinality.
Connects an AI-assisted decision to an appropriate notice, a comprehensible explanation and a route for correction or contest. It records human review and the disposition of the affected person's concern.
Control: Assemble a minimized, audience-appropriate decision record from verified outcomes and relevant reasons. Authenticate access, redact unrelated data and link correction or contest outcomes to the original decision.
Reported evidence: Decision-specific notices, explanations, challenge intake and resolution events.
practical_trust.recourse.open; practical_trust.decision.id; practical_trust.recourse.outcome
No universal right to raw traces or hidden reasoning is implied. Applicable rights and disclosure duties depend on the actual law and facts.
Build the trace from instrumented observations and correlate it with independently generated authorization, credential, gateway and downstream records. A distributed task may involve several linked traces, asynchronous actions and non-OTel records. Trace context connects observations; it does not authenticate a person, delegate permission or prove a business outcome.
Identify the emitting service, instance, environment and instrumentation. Corroborate self-asserted values with authenticated platform or gateway context.
Track the agent, tool call, data source, model and provider response where supported. Provider and model strings may be aliases or proxy observations.
Compare artifact digests with a trusted approved manifest and verify signatures and publisher identity. Hashes do not prove correctness, safety, origin or anonymization by themselves.
Join the approved action, credential issue and actual downstream effect. Investigate mismatched or missing records and validate producer coverage before assuming an action did not occur.
Document fields essential for each operation and test the actual emitter. Required and conditional fields are operation-specific. Recommended fields cannot be assumed to arrive.
Decide purpose, access, destination and retention before capture. Verify support in the selected SDK; there is no universal switch guaranteed to govern every integration. Metadata can also be sensitive.
Authenticate inputs, restrict exposed listeners, protect secrets, review transformations and monitor exporter health. Minimize content before it enters shared buffers and downstream stores.
Head sampling can discard evidence that tail sampling cannot recover. Keep mandatory material-action records through a separate durable path where needed and test loss, buffering and outage behavior.
Bounded aggregate latency, usage, error and evaluation measures. Control label cardinality; trace sampling can bias derived series.
Operation and version relationships with approved retention and analyst access. Preserve required audit records independently of diagnostic sampling.
Curated findings and authoritative action records correlated with identity, gateway, change and downstream evidence. ECS/OCSF mapping is explicit and versioned.
Only justified, approved content capture with access controls, minimization, retention and evidence pointers. These tiers can be separate stores or governed partitions of one platform.
These are logical tiers, which may be governed partitions within the same technology platform. There is no universal storage-cost ratio or rule that all raw traces are inappropriate for a SIEM. Volume, query patterns, cardinality, privacy, retention and recovery requirements determine the design.
The rules below are illustrative hypotheses, not deployed detections, prevalence statistics or legal conclusions. In Harness step 6, compare the approved and deviation specimens using the existing explanation controls.
Lead: Requested/responding model differs from the approved mapping.
Evidence: Configuration metadata + approved deployment inventory
Response and limit: Distinguish approved alias resolution from substitution; request deployment evidence and assess whether revalidation is needed.
Lead: Provider/endpoint differs from the authorized route.
Evidence: Metadata + independent gateway/egress record
Response and limit: Investigate bypass and residency implications; a provider string alone does not establish the location or ultimate processor.
Lead: The observed tool is outside the registered task tool set.
Evidence: Tool metadata + independently controlled allowlist
Response and limit: Block in the dispatcher before execution where possible; record the attempt. A missing approval record also requires a pipeline-loss check.
Lead: A new source or excessive retrieval limit appears.
Evidence: Retrieval metadata + access and index records
Response and limit: Confirm effective permissions and task purpose. Missing fields are evidence gaps, not proof that access was allowed.
Lead: Untrusted retrieval or memory precedes an unusual action.
Evidence: Whole-trace/link context + provenance labels
Response and limit: Investigate as a lead, not proof of injection. Obtain restricted content only with an approved purpose and access path.
Lead: Usage or cumulative task cost exceeds a validated budget/baseline.
Evidence: Metadata + bounded metrics + billing/control records
Response and limit: Enforce approved limits including concurrency, children and retries. An anomaly is not proof of exfiltration; baseline windows need sufficient representative data.
Lead: Finish reasons or validation results change materially.
Evidence: Provider context + outcome metrics + deployment records
Response and limit: Verify actual settings and workload changes. Zero content-filter responses does not establish that filtering was disabled.
Lead: Memory writes/deletes violate approved scope or retention policy.
Evidence: Operation evidence + independent store confirmation
Response and limit: Verify affected records and downstream erasure. A missing record ID cannot establish deletion of the whole store.
Lead: Unexpected authorization failures, timeouts or throttling.
Evidence: Typed errors + identity/gateway/provider evidence
Response and limit: Interpret the actual library/provider error taxonomy before rotating credentials or interrupting work.
Lead: A prohibited sensitive field arrives in an evidence destination.
Evidence: Capture policy + schema/field-presence checks
Response and limit: Stop further unauthorized collection, restrict access and assess retention/incident obligations; do not copy payloads into general alerts.
Lead: A reported artifact digest differs from the trusted approved release.
Evidence: Trusted registry + producer-verified digest
Response and limit: Check origin and release records. Digest matching alone does not prove authenticity, correctness or protection from manipulation.
Lead: Approved validation detects a potential output/content problem.
Evidence: Authorized content processing or evaluation results
Response and limit: Use risk-calibrated review and controls. Classifiers can miss problems or raise false positives; record their versions and limitations.
Reporting is not enforcement. OpenTelemetry supplies observations and conventions, not an authorization engine, immutable archive or complete shadow-AI inventory. Protect evidence outside the agent's administrative reach and corroborate consequential actions.
Evaluation telemetry already exists. The current GenAI event convention includes gen_ai.evaluation.result. The proposed practical_trust.* operations and attributes add organization-specific control and lifecycle context; they are not official GenAI fields.
Missing or anomalous metadata is not a finding of misconduct. Investigate collection failures, configuration changes, legitimate workload shifts and provider-specific semantics. A missing memory record ID does not prove a bulk erasure; a lower content-filter count does not prove that a filter was switched off.
No automatic compliance conclusion. Framework mapping is contextual. Retention, human review, disclosure, recourse and regulatory reporting depend on the entity, system, role and jurisdiction. The inherited financial library's source dates are unchanged. This addition does not import the source note's SR 11-7 references or assert that telemetry satisfies banking model-risk guidance.
No fabricated measurements. The original note's adoption percentages, fixed cost ratios, incident claims and universal two-week baseline recommendation have not been republished. The on-screen examples are synthetic.
Checked October 15, 2026 for this educational integration. GenAI material remains marked Development in the checked repository. The links to main are evolving references, not a pinned production dependency. Pin the exact schema and instrumentation version during implementation.
OpenTelemetry: traces and spans - Span structure, context and links
OpenTelemetry: resources - Resource identity and service attributes
OpenTelemetry: semantic conventions - Schema meaning and version governance
OpenTelemetry: attribute requirement levels - Required, conditional, recommended and opt-in levels
OpenTelemetry GenAI client spans - Development - Operation-specific fields, logical retries, content handling
OpenTelemetry GenAI evaluation events - Development - gen_ai.evaluation.result and related evaluation fields
OpenTelemetry: sampling - Head and tail sampling trade-offs
OpenTelemetry: handling sensitive data - Minimization, processing and residual sensitivity
OpenTelemetry: Collector configuration best practices - Protecting receivers, credentials and deployment
OpenTelemetry: Collector internal telemetry - Operational health, queue and loss monitoring
OpenTelemetry: Collector resiliency - Queues, retries and persistent buffering
OpenTelemetry Protocol specification - Telemetry transport and delivery responses
OpenTelemetry: baggage - Context propagation and sensitive-data cautions
W3C Trace Context - traceparent, tracestate and trust/privacy considerations
OpenTelemetry: metrics - Aggregated measurements and metric instruments
OpenTelemetry Collector architecture - Receivers, processors, exporters and connectors
NIST AI RMF and Generative AI Profile - Voluntary lifecycle governance; implementation commentary is original
NIST SP 800-207: Zero Trust Architecture - Separate policy decision and enforcement; contextual authorization
Elastic Common Schema reference - Event-field mapping and trace linkage
Open Cybersecurity Schema Framework - Security event schema; mapping is implementation work
Inter-agentic circular threat atlas · Animated harness telemetry to Elastic · Complete integrated source reference
Source-derived evidence and clearly labeled simulation. No live enterprise connection.