AI Agent Safety: Permissions and Rollback
October 14, 2026
AI Accelerators Beyond TOPS: Memory, Bandwidth and Real Workloads
October 14, 2026
Traditional application logs tell you that a request failed. Agent observability must also explain the trajectory: what the model saw, which tool it selected, what the tool returned, where a handoff occurred and which control allowed the final result.
Trace the observable system
OpenAI’s Agents SDK documentation describes traces containing model calls, tool calls, handoffs, guardrails and custom spans. A useful trace also records timing, status, validated parameters, source identifiers and approvals.
Do not rely on private chain-of-thought as the operational record. The evidence is in observable inputs, decisions, actions and outputs.
Three levels of signals
Outcome metrics: Was the task completed correctly? Was the user or downstream system satisfied?
Process metrics: Were the correct sources and tools used? How many retries, handoffs and tokens were required?
Safety metrics: Did the agent request approval, respect data boundaries and avoid prohibited actions?
An outcome can be correct despite a dangerous process. A safe process can still produce a useless answer. Monitor both.
Find the first wrong step
Suppose a final report cites the wrong price. The last generation step may only repeat an earlier error. Trace backward until the first unsupported state appears: the wrong source was retrieved, a date filter was missing or a tool returned ambiguous units. Repair that boundary rather than adding a final instruction to “be accurate.”
Design privacy before logging
Traces may contain prompts, documents, tool arguments and personal data. Collect the minimum needed for debugging and evaluation. Apply access controls, retention limits and redaction. Keep credentials outside trace payloads. Observability that exposes secrets is a production defect.
Build operational views
Track failure rate by task type, tool and version. Watch latency distributions rather than averages. Record unknown token counts as unknown, not zero. Compare model or prompt changes on the same evaluation set. Link important failures to a reproducible case and the change that fixed them.
Telemetry, latency and throughput answer different questions
Telemetry is the evidence a system emits about its behavior. The OpenTelemetry primer distinguishes logs, metrics and traces: logs record timestamped events, metrics summarize numeric measurements over time, and traces connect spans representing operations along a request’s path. Observability is the ability to investigate behavior using that evidence; emitting more records does not by itself establish why a result was wrong.
For a report workflow, define latency as elapsed time from an accepted request to its finished report, including any waiting inside that boundary. Throughput counts completed reports per stated time window. IBM’s data-pipeline explanation uses data processed within a given time; the workflow measure needs its own unit and completion rule. One fast request does not establish a sustained processing rate. Compare the same task scope, workload and window.
In the fictional wrong-price report above, a latency measurement describes the delay; throughput describes the completion rate. Neither tells you where the price became unsupported. Correlate the relevant step records and inspect the available source context. If that context was never recorded, mark the gap rather than claiming the trace proves the cause.
Alerts need action
Alert on repeated tool failures, unusual write volume, budget exhaustion, missing approvals and safety-rule violations. Every alert should name an owner and a response. Otherwise it becomes background noise.
When full tracing is unnecessary
A low-risk, one-step transformation may need only normal application logs and sampled outputs. Increase trace detail with autonomy and consequence. Use configurable sampling or privacy-preserving summaries rather than removing observability entirely.
Continue with How to Evaluate an AI Agent, How the ReAct Loop Works and Continual Improvement.
Primary sources
Adaptation note: This article was informed by evaluation and observability concepts in AI Agents in Depth: Design Principles and Engineering Practice by Bojie Li and contributors, Apache License 2.0. It was independently rewritten and expanded for Stariy.com.
