Agentic Observability

Overview

Canonical Agentic observability has three layers:

1. Activity → Runs records every normal SDK workflow lifecycle and immutable topology snapshot.
2. Activity → Decisions records every workspace authorization decision and its integrity evidence.
3. Activity → Trends aggregates executions, verdicts, tools, identities, frameworks, status, and latency for a selected time window.

Optional OpenTelemetry/Langfuse export is asynchronous and can be sampled. The local execution and authorization ledgers are not optional telemetry: they remain workspace-scoped and are captured independently of export sampling.

Where to view Agentic activity

Surface	Use it for
Agentic → Activity → Runs	Open one workflow and inspect its topology, actors, roles, permissions, tools/actions, delegations, and per-check decisions.
Agentic → Activity → Decisions	Search/filter individual decisions, inspect check evidence, paginate at the server, and export the current filtered page as CSV.
Agentic → Activity → Trends	Review time-windowed execution, verdict, tool, identity, framework, status, and latency trends.
Agentic → Assets → Networks	Inspect the most recently discovered design-time topology and drift state.
Policy & Access → Advanced relationships → Changes	Review mediated OpenFGA relationship writes and deletes.

Legacy Agentic Observability trace bookmarks redirect to Activity → Runs. The former Posture, Findings, In-Line Control, Service Graph, and score dashboards are not separate evidence sources. Their useful investigation paths are covered by clickable run evidence, Assets drift/quarantine, Work Queue, Policy & Access approvals, Activity decisions, and Activity trends.

Execution detail

The SDK starts an execution at the framework boundary, associates governed decisions with it, and closes it as complete, blocked, failed, cancelled, or awaiting approval.

Open a run to inspect:

• Topology snapshot — agents, tools, named actions, and graph edges captured from the workflow that actually ran.
• Topology integrity — verification that the submitted topology matches the immutable recorded snapshot.
• Actor identity — the Virtual-Key-bound agent and optional acting user or service account.
• Authorization graph — the relevant relationship closure through groups, roles, permissions, resources, tools/actions, and delegations.
• Decision edges — the allowed/denied result of acts_for, permission, can_use, can_execute, and context checks.
• Decision evidence — verdict, reason, failed check, action, argument protection, and integrity-chain status.

Nodes and edges are clickable. Large decision sets use bounded server pages and show when the current graph contains only one evidence page; use the pager to inspect every step.

Discovery and execution are different

Assets → Networks is the latest discovered design-time workflow. Activity → Runs is the immutable snapshot and authorization evidence for one concrete run. A discovered tool is not automatically authorized.

Decisions

Agentic → Activity → Decisions reads the canonical decision ledger rather than a generic LLM request log.

Use its server-side filters for:

• time range;
• search text;
• verdict;
• agent or acting identity;
• tool and named action;
• permission/object;
• failed check.

Opening a row shows the request identity, verdict/reason, every authorization check, linked run, and a plain-language integrity status. CSV export contains the current server-filtered evidence page; pagination and totals are explicit.

Tool arguments are bound to the decision with a cryptographic digest rather than the raw payload. The normal UI reports that protection without displaying the digest. The gateway does not put workload tokens, Virtual Key bearers, or raw tool arguments into the decision record.

Trends

Agentic → Activity → Trends calculates exact server-side aggregates for the selected window instead of deriving totals from the visible table page.

The dashboard includes:

• executions, active runs, completion rate, and run duration;
• Allow, Deny, and Require-approval counts and decision latency;
• execution status distribution;
• top tools and named actions;
• top agents and acting users/service accounts;
• framework distribution;
• bucketed decision/execution timeline; and
• recent executions linked to their evidence.

Available windows range from one hour to 30 days. Refresh re-queries both aggregates and recent executions.

Backend-managed telemetry export

Telemetry destinations and credentials are deployment settings. They are not shown or editable in the Agentic workspace UI. The bundled local Docker stack starts Langfuse and connects the DeepIntShield backend automatically. Other deployments inject the collector settings through their secret manager.

Canonical execution and authorization evidence remains local and complete, whether or not an external exporter is configured.

Langfuse

Set the deployment endpoint:

DEEPINTSHIELD_LANGFUSE_ENDPOINT=http://langfuse-web.langfuse.svc.cluster.local:3000
DEEPINTSHIELD_LANGFUSE_PUBLIC_KEY=pk-lf-...
DEEPINTSHIELD_LANGFUSE_SECRET_KEY=sk-lf-...

The backend uses the same project keys for asynchronous OTLP export and read-only trace enrichment. Leave the endpoint unset to keep only the canonical local ledgers.

OpenTelemetry

Point optional fan-out at an OTLP/HTTP backend:

DEEPINTSHIELD_OTLP_ENDPOINT=https://otlp.example.com
DEEPINTSHIELD_OTLP_HEADERS=Authorization=Bearer-replace-me,X-Scope-OrgID=team

Store real credentials in the deployment secret manager rather than source control.

Performance and failure behavior

• Authorization stays synchronous and fail-closed.
• Workflow discovery, SIEM delivery, and optional trace export use bounded background paths.
• Analytics uses server-side aggregates and bounded paging rather than loading an unbounded workspace history into the browser.
• Export failure cannot turn a Deny into an Allow or remove local authorization evidence.

Asynchronous export minimizes hot-path impact, while the synchronous authorization check, request-path instrumentation, and any cache miss retain measurable cost.

Privacy posture

For the strictest posture:

1. Leave external telemetry endpoints unset.
2. Keep sensitive-data redaction and tool-argument protection enabled.
3. Leave masked prompt preview disabled.
4. Review workload/Virtual Key logs for accidental application-side logging.
5. Use Activity → Decisions and Activity → Runs as the local evidence source.

The stored execution topology contains structure and canonical references, not raw prompts or tool arguments. The everyday UI resolves those references to friendly labels. The decision ledger contains protected argument bindings and authorization metadata.

Next steps

• Agentic Security — operate the Work Queue, Assets, Policy & Access, and Activity surfaces.
• Relationship Authorization — model roles, object access, tools/actions, and delegation.
• OpenTelemetry — configure collectors and vendor-neutral export.
• Built-in Observability — inspect LLM request telemetry outside the Agentic decision ledger.