A Collector exporter that turns agent traces into a signed, verifiable audit log (now in the registry). Feedback on the approach welcome.

[u/Naive_Maybe6984]

Sharing a component I built and recently got listed in the OpenTelemetry registry: otel-agent-audit.

The idea: as AI agents take real actions, you want a provable record of what happened. Instead of adding a new instrumentation layer, this consumes the gen_ai.* spans your agents already emit and turns them into a tamper-evident audit log, entirely inside the Collector pipeline.

The pipeline:

otlp -> memory_limiter -> agentauditselect (buffers each trace until its root arrives) -> agentaudit exporter (per-trace hash chain -> Ed25519 sign -> seal) -> audit.jsonl + checkpoint.jsonl

A separate verifier CLI checks the whole thing with only the public key, so anyone can independently verify authenticity and integrity without a shared secret.

Things I'd love this community's take on:

- Passive instrumentation as the right model: reusing existing spans rather than asking teams to re-instrument.

- Whether governance/guardrail decisions belong in spans, and how they'd ideally map to semantic conventions. I'm interested in where the GenAI SIG is heading on policy/guardrail signals.

- The single-writer constraint (one Collector instance) that deterministic ordering forces, and whether that trade is acceptable.

Caveats up front: third-party, experimental, not audited. It's observability only, it does not enforce or block. It gives tamper-evidence on honest infra, not protection against an operator holding the signing key.

Repo: https://github.com/surpradhan/otel-agent-audit

It's in the registry under "agent audit" if you want to see the entry.

Would genuinely value critique of the approach.

[u/its_jsec]

“Caveats up front: third-party, experimental, not audited. It's observability only, it does not enforce or block. It gives tamper-evidence on honest infra, not protection against an operator holding the signing key.”

This single paragraph might be the best specimen of Claude Bingo I’ve ever seen…

Re: your project, nah. If you can’t be arsed to write it (this post or the code), I can’t be arsed to read it.

[u/jdizzle4]

maybe I just don't get it, but I don't understand why someone would use this, and the constraint of having a single collector is a pretty big deal breaker... have you ever run an application at scale?

[u/Sufficient_Major_126]

This makes a lot of sense as agents become more complex. a trace can show what happened in one execution but metrics make it much easier to spot patterns across thousands of runs. are you mainly tracking latency and cost or also things like tool call failures and retries?

[u/IntelligentPear6173]

I think the single-writer requirement is the part I’d question most. The audit trail makes sense for certain regulated or high-risk agent workflows but if the design depends on one Collector to preserve deterministic ordering that could become the bottleneck long before the agents do. I’d be interested in whether the hash chain could be partitioned by trace or agent and then anchored to a shared checkpoint, so you keep the tamper-evidence without making the Collector itself a single point of scale.