Observability / Structured Logging
FR EN

Observability

Structured Logging

Structured logging: capture, in a usable form, the security events across the whole AI chain.

Plane
Observability
Flow steps
8
Frameworks
NIST 800-53

Technology

Why use it

Produce structured, correlatable logs covering prompts, decisions, agent actions and data access.

Why it matters to security

Without usable logs there is no detection, investigation or evidence: logging is the prerequisite of all defense.

Implementations OpenTelemetrystructured JSON logsLoki / Elasticcommon event schema

What isn’t logged never happened, from a security standpoint.

Recommendations by maturity tier

Hover a recommendation for its explanation · each one carries its control number

Foundation

Minimum viable baseline
  • Logging of key security events.
    NIST 800-53 AU-2
    Authentications, decisions, agent actions, data access.
  • Sufficient event content (who, what, when).
    NIST 800-53 AU-3
    A log with no context is unusable.
  • Record generation at the source.
    NIST 800-53 AU-12
    Each component emits its own logs.

Enterprise

Enterprise standard
  • Structured, correlatable logs (request ID).
    NIST 800-53 AU-3
    One ID links all events of a request.
  • Synchronized timestamps across components.
    NIST 800-53 AU-8
    Without aligned clocks, correlation is impossible.
  • Log centralization.
    NIST 800-53 AU-6
    Scattered logs don’t correlate.

Advanced

High-assurance / regulated
  • AI-specific logging (prompt, model, cost, verdict).
    NIST 800-53 AU-2 · AU-3
    Capture what is specific to AI systems, not just HTTP.
  • Protection of sensitive data in logs.
    NIST 800-53 AU-9 · SI-15
    Logs must not become a PII leak.
  • Retention aligned with compliance.
    NIST 800-53 AU-11
    Retention meets legal obligations.

Architecture notes

  • Log the prompt and the decision, not just the HTTP request.details ▸
    AI security plays out at the semantic level.
    Capture prompt, retrieved sources, tools called and the PDP verdict, with a shared correlation ID.

References

NIST SP 800-53 Rev5
AU-2 (Event Logging), AU-3 (Content), AU-8 (Time Stamps), AU-9 (Protection), AU-11 (Retention), AU-12 (Generation).

Abbreviations

PDP
Policy Decision Point
PEP
Policy Enforcement Point
PIP
Policy Information Point
PAP
Policy Administration Point
IdP
Identity Provider
TSS
Token Service
NHI
Non-Human Identity
RBAC
Role-Based Access Control
ABAC
Attribute-Based Access Control
MFA
Multi-Factor Authentication
HITL
Human-in-the-loop
JIT
Just-In-Time
CAE
Continuous Access Evaluation
CAEP
Continuous Access Evaluation Profile
DPoP
Demonstrating Proof-of-Possession
mTLS
mutual TLS
PII
Personally Identifiable Information
KMS
Key Management Service
CI/CD
Continuous Integration / Continuous Delivery
SIEM
Security Information and Event Management
SOAR
Security Orchestration, Automation and Response
SCIM
System for Cross-domain Identity Management
XACML
eXtensible Access Control Markup Language
OPA
Open Policy Agent
OWASP
Open Worldwide Application Security Project
NIST
National Institute of Standards and Technology
ATLAS
Adversarial Threat Landscape for Artificial-Intelligence Systems
LLM
Large Language Model
WAF
Web Application Firewall
CDN
Content Delivery Network
DDoS
Distributed Denial of Service
DLP
Data Loss Prevention
JWT
JSON Web Token
API
Application Programming Interface
CRS
Core Rule Set (OWASP)
RAG
Retrieval-Augmented Generation
MCP
Model Context Protocol
PBAC
Permission-Based Access Control
HSM
Hardware Security Module
UEBA
User and Entity Behavior Analytics
SBOM
Software Bill of Materials
SLSA
Supply-chain Levels for Software Artifacts
WORM
Write Once, Read Many
SPIFFE
Secure Production Identity Framework For Everyone