# Log AI tool calls as privileged operations—not just chat transcripts > A chat transcript cannot prove which identity, permission, tool, parameters, approval, or downstream result produced a business change. Build a protected event chain around every AI tool invocation while keeping secrets and sensitive content out of routine telemetry. - Canonical URL: https://update.dsesecurity.com/updates/log-ai-tool-calls-privileged-operations/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: Gavin Stewart - Published: 2026-08-17T13:28:00+00:00 - Modified: 2026-08-17T19:22:08+00:00 - Last reviewed by DSE: 2026-08-17 - Resource type: Playbook - DSE priority: Important - Topics: Cybersecurity, IT - Reading time: 3 minutes ## What you need to know A chat transcript cannot prove which identity, permission, tool, parameters, approval, or downstream result produced a business change. Build a protected event chain around every AI tool invocation while keeping secrets and sensitive content out of routine telemetry. ## Potentially affected Tool-using AI agents; model and orchestration services; APIs; databases; tickets; email and workflow systems; approval services; identities and tokens; observability pipelines; SIEM platforms; and audit retention. ## DSE recommendation Define a tool-call event schema, correlate the full execution chain, record authorization and approval decisions, protect telemetry independently from the agent, redact sensitive values, alert on behavioral change, and test incident reconstruction. ## Article ## Source facts: a tool invocation is an execution boundary Microsoft’s [runtime-risk guidance for AI agents](https://www.microsoft.com/en-us/security/blog/2026/01/23/runtime-risk-realtime-defense-securing-ai-agents/) describes tool invocations as high-value, high-risk events. In the Microsoft product pattern discussed, context about a planned invocation can be evaluated before execution so policy can allow or block it. The larger principle is product independent: once a model can call an API, update a record, send a message, or run code, observability must extend beyond generated text. OpenTelemetry publishes GenAI semantic attributes for operations, agents, conversations, retrieval, tool definitions, tool-call identifiers, arguments, and results. Its documentation also warns that messages, queries, arguments, and results may contain sensitive information. Some GenAI conventions are still in development or have moved between repositories, so they are useful building blocks rather than a finished compliance record that every implementation can adopt unchanged. A transcript can show what the user asked and what the assistant claimed it did. It cannot by itself prove which agent version ran, what context was retrieved, which identity obtained a token, what permission was evaluated, whether approval occurred, which exact parameters reached the tool, what the downstream system accepted, or whether a retry created duplicate effects. Those facts require events from the orchestrator, identity layer, policy point, tool gateway, and target system. ## DSE recommendation: create one reconstructable chain from request to effect Design the audit path before production. Start with the decisions investigators, administrators, customers, and reviewers would need to reproduce after an unexpected change. - Assign stable identities and versions. Record the human requester, agent identity, orchestrator, model and version, governing prompt or policy version, tool server, tool definition version, deployment environment, and target tenant. Distinguish acting as the user from acting as the agent’s own service identity. - Correlate the execution. Generate a request ID and carry it through planning, retrieval, policy evaluation, token issuance, approval, each tool attempt, target-system response, retry, rollback, and final user message. Keep parent and child relationships when one request creates several calls or sub-agents. - Record the control decisions. Capture requested operation, target, authorization scope, policy result, approval requirement, reviewer, decision time, expiry, denial reason, rate limit, and stop condition. Record the enforced decision, not merely the model’s explanation of why an action should be allowed. - Protect content selectively. Prefer hashes, object IDs, field names, counts, classifications, and redacted summaries when full arguments or results are unnecessary. Never copy access tokens, passwords, private keys, or whole sensitive records into ordinary traces. Place any content-rich forensic record behind stricter access and retention. - Keep evidence outside the agent’s control. Send security-relevant events to a protected collector the agent and tool cannot alter or delete. Monitor missing exporters, sequence gaps, clock problems, schema changes, disabled instrumentation, and unexplained differences between orchestrator and target-system logs. - Test reconstruction and response. Run a controlled action, then ask an independent reviewer to identify who requested it, what evidence was used, which permissions and approvals applied, what changed, whether retries occurred, and how to revoke the agent. Exercise unexpected denial, partial completion, tool timeout, and rollback. Factual boundary: OpenTelemetry conventions standardize useful fields but do not guarantee that an implementation records every event, protects the record, or preserves semantic truth. Logging tool inputs and results can itself create privacy and credential risk. Microsoft product behavior described in the primary source should not be represented as a capability of every agent platform. Measure tool calls without correlation, unknown agent versions, approval-to-execution delay, denied and retried calls, missing target confirmations, sensitive-field redactions, and reconstruction test success. The goal is evidence that survives the conversation: enough to explain and contain the real operation without turning the logging system into a second sensitive-data store. ## Official references - Microsoft Security, [From runtime risk to real-time defense: Securing AI agents](https://www.microsoft.com/en-us/security/blog/2026/01/23/runtime-risk-realtime-defense-securing-ai-agents/), January 23, 2026. - OpenTelemetry, [Generative AI semantic attributes](https://opentelemetry.io/docs/specs/semconv/registry/attributes/gen-ai/); stability notices should be reviewed before adoption. - NIST, [Generative Artificial Intelligence Profile](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence), NIST AI 600-1. ## Primary reference - Name: Microsoft Security: From runtime risk to real-time defense - Authority: www.microsoft.com - URL: https://www.microsoft.com/en-us/security/blog/2026/01/23/runtime-risk-realtime-defense-securing-ai-agents/ - Source publication date: 2026-01-23 ## Citation and use Preferred citation: “Log AI tool calls as privileged operations—not just chat transcripts,” DSE Security, https://update.dsesecurity.com/updates/log-ai-tool-calls-privileged-operations/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.