Back to the CIO and CSO starting point Security and GRC hub
AI Observability and Audit Logging: What Each Route Logs
AI audit logging is the record of who used an AI system, what they did, and what the system returned. Lightbridge separates content logging from metadata logging, because routes differ sharply on which they keep, for how long, and who can read it. This page compares what each route logs and what it omits.
It is part of the Lightbridge AI security series. Read it next to how Lightbridge compares AI access paths, since the route you pick decides which logs you get. Vendor statements are attributed and linked. We fetched each source on 2026-11-03; most pages carry no date of their own, and the dates that pages do show are listed under the table. Lightbridge does not recommend a vendor here.
Content versus metadata: the choice Lightbridge asks clients to make first.
Two kinds of record matter. Metadata says who called which model, when, and how much it used. Content says what was typed and what came back. Metadata is usually enough to answer who and when. Content is what an incident responder needs to answer what was disclosed.
Content logs carry their own risk. OpenTelemetry's GenAI spans document states instructions, user messages and model outputs are considered sensitive, that instrumentations should not capture them by default, and that they should offer an opt-in. It describes recording them on span attributes or storing them externally with references, and recommends the external option for production (OpenTelemetry GenAI spans, fetched 2026-11-03).
Lightbridge's advice: decide per route and per data class. Keep metadata everywhere. Turn on content capture only where a named owner has set access, retention and deletion rules for the log store.
What each route logs and omits, as vendors state it and Lightbridge reads it.
The table covers the routes Lightbridge compares most often. Each cell is what the vendor states, with sources linked per row. Sources were fetched 2026-11-03. The Azure pages we read describe the classic portal. Cells marked "Not stated in the documentation we reviewed" are gaps, not answers.
| Route | Logging feature and default | What it records | Retention | What it omits |
|---|---|---|---|---|
| Anthropic: Claude Enterprise and Console | Anthropic states the Compliance API gives programmatic access to the Activity Feed, and for Claude Enterprise also directory data, effective settings, chats, files, projects and sessions in Cowork, Claude Code and other listed apps. A standalone Console organization can query the Activity Feed only (source). | Anthropic states activities are queryable within 1 minute. Session transcripts carry user prompts, assistant responses and tool activity (source). | Anthropic states the Activity Feed is retained for 6 years and recording is not retroactive: it starts when the Compliance API is first enabled. Anthropic states local session transcripts are kept 6 years by default, 30 days with HIPAA readiness, or the organization's custom period when a finite one is set (source). | Anthropic states the Compliance API excludes prompt text and responses from Console or API-key workloads, and Claude Code usage through Amazon Bedrock, Google Cloud or Microsoft Foundry. Anthropic states transcripts omit thinking blocks, images and binary content, and that the claude.ai audit log CSV export has a capped lookback and no chat, file or project content. |
| OpenAI: ChatGPT Enterprise and Edu | OpenAI states the Compliance Platform has two patterns: a Compliance Logs Platform of immutable, append-only events, and a Stateful Compliance API for state at request time (source). | OpenAI states locked-chat messages are included in conversation message logs, and an account PIN does not prevent authorized Compliance Platform access. | OpenAI states the Compliance Logs Platform retains data for 30 days and tells customers who want longer to download and keep logs. | OpenAI states the Compliance Platform is available to ChatGPT Enterprise and Edu workspaces. OpenAI states the earlier stateful conversation route was removed on 5 June 2026, replaced by conversation logs released 5 March 2026. |
| OpenAI: API Platform | Audit logs, enabled by an organization owner and, per OpenAI, not disableable in settings once enabled (source). | OpenAI states they record administrative and organization-configuration events. | OpenAI states no fixed retention period, kept on a best-effort basis without a permanence guarantee. | OpenAI states they are separate from API request and response customer content. Customer-side request and response logging: Not stated in the documentation we reviewed. |
| Amazon Bedrock | Model invocation logging, disabled by default, to CloudWatch Logs or S3 in the same account and Region (source). Separately, CloudTrail (source). | AWS states invocation logs hold full request data, response data and metadata, with fields such as requestId, operation, modelId, identity.arn, input and output bodies, and token counts. Inline bodies run up to 100 KB, with larger or binary data going to S3. AWS states CloudTrail logs InvokeModel, InvokeModelWithResponseStream, Converse, ConverseStream and ListAsyncInvokes as management events. It lists InvokeModelWithBidirectionalStream, GetAsyncInvoke, StartAsyncInvokes and agent invocations as data events, a separate CloudTrail category. | AWS states invocation logs are stored until the logging configuration is deleted. | AWS states invocation logging works only for calls through the bedrock-runtime endpoint, not bedrock-mantle. requestMetadata is the only caller-supplied field. AWS states CloudTrail data events are not logged by default (source). Whether CloudTrail events exclude prompt content: Not stated in the documentation we reviewed. |
| Google Vertex AI (Gemini Enterprise Agent Platform) | Request-response logging to BigQuery, disabled by default until a PublisherModelConfig is set, with a sampling rate. Anthropic models are configured by REST only (source). Audit logs: Admin Activity and System Event always on, Data Access off by default (source). | Google states the BigQuery schema includes full_request and full_response JSON and an optional otel_log. The Data Access category lists endpoints.predict, endpoints.rawPredict and endpoints.explain. | Not stated in the documentation we reviewed. | Google states request-response pairs over the BigQuery 10 MB write API row limit are not recorded. Some partner (MaaS) models may require logs be shared with the partner's trust and safety team; Google lists Anthropic's advanced models as supporting this, and states VPC Service Controls projects are blocked from sharing by default. Google marks that sharing feature Preview. |
| Azure OpenAI and Foundry | Microsoft states platform metrics and the activity log are collected automatically, but resource logs are not collected until a diagnostic setting routes them to Log Analytics, Storage or Event Hubs (source). | Microsoft lists log categories Audit, AzureOpenAIRequestUsage, ManagedNetworkEvent, RequestResponse and Trace (source). Whether RequestResponse holds prompt and completion bodies: Not stated in the documentation we reviewed. | Abuse monitoring storage duration: Not stated in the documentation we reviewed. | Separate from your logs, Microsoft states flagged prompts and completions may be sampled for automated review or, in some cases, human review, and that the abuse monitoring store is logically separated by customer resource and sits in the resource's geography (source). Customers meeting Limited Access criteria may apply to modify abuse monitoring; Microsoft states detection of potential abuse may then be less accurate. |
Sources fetched 2026-11-03. Page dates where the page shows one: Google request-response logging, last updated 2026-10-30; Microsoft Azure OpenAI monitoring, last updated 02/27/2026; Microsoft monitoring data reference, ms.date 2025-11-26; Microsoft abuse monitoring, last updated 05/19/2026. The other vendor pages show no date we could record. Which of these routes you can use is a separate question; the access path comparison covers it.
Gateway logging: what one product states, as Lightbridge reads it.
A gateway sits between your applications and the model providers, so it can give you one log format across routes. Cloudflare states AI Gateway logs can include prompt, response, provider, timestamp, status, token usage, cost, duration and user agent. It states logging is enabled by default per gateway, can be turned off, and that a per-request header can disable payload storage while keeping metadata (Cloudflare AI Gateway logging, fetched 2026-11-03).
That is one product. We did not research LiteLLM, Kong, Portkey or other gateways, so we make no claim about them. The default matters: a gateway that logs payloads by default creates a new store of prompts that needs the same controls as any other. Lightbridge Automation covers the gateway pattern on its LLM gateways guide.
Retention and access: the questions Lightbridge puts to every log store.
The table shows retention ranging from 30 days to 6 years to unstated. A short vendor window is fine if you export on a schedule. OpenAI tells Compliance Logs Platform customers who want longer retention to download and keep logs. Anthropic states Activity Feed recording is not retroactive, so the clock starts when you enable it.
Ask five questions of each store. Who can read it. Who can change or delete it. How long it lasts. Where it lives. Whether it is covered by your retention terms with the vendor. Anthropic also states all /v1/compliance/* endpoints share 600 requests per minute per parent organization (Anthropic Compliance API), which matters when you pull logs into a SIEM at scale.
Zero data retention interacts with logging in ways worth checking in the contract. OpenAI states Zero Data Retention does not change its API audit logs. Lightbridge Automation owns the explainer on zero data retention. The legal side of retention terms sits on the Lightbridge AI contracts and legal page.
OpenTelemetry GenAI conventions: status as Lightbridge reads the sources.
OpenTelemetry states its GenAI semantic conventions moved to a separate semantic-conventions-genai repository and are no longer maintained in the main semantic-conventions repository (moved notice, fetched 2026-11-03). The agent spans and client spans documents there are marked Status: Development (agent spans, client spans). The repository states it defines spans, metrics and events for GenAI clients, MCP, and provider-specific conventions (repository README).
Practical read: useful for a shared vocabulary, not yet a fixed contract. Anthropic states Cowork and Claude Code stream per-event OpenTelemetry telemetry to a collector you run, and that this can also capture prompts and responses (Anthropic Compliance API). Google's BigQuery schema carries an optional otel_log field (Google request-response logging). Metrics and events stability was not confirmed in the sources we reviewed.
Agent tracing raises its own questions, covered on the Lightbridge AI agent security page.
What evidence auditors and questionnaires expect, and what Lightbridge suggests keeping.
We did not review customer questionnaires or audit programs for this page. The standards guidance gives a floor. NIST AI 600-1 (July 2024) states documentation practices including logging, recording and analyzing incidents can facilitate sharing information with relevant parties, and suggests procedures to record and track reported errors, near-misses and negative impacts (action MG-4.3-002) (NIST AI 600-1). OWASP's 2025 LLM Top 10 recommends logging and monitoring of unusual output patterns, extension and downstream activity, and detailed immutable logs of retrieval (OWASP LLM Top 10 2025). Both documents were fetched 2026-11-03. Retention periods were not checked: our NIST extraction was a partial summary of a 64-page PDF.
Lightbridge suggests keeping this evidence pack, as judgment and not a sourced requirement:
- A route-by-route list of which logs are on, with the setting screenshot or export and its date.
- The owner, reader list and retention period of each log store.
- A sample redacted record for each route, showing the fields captured.
- Proof of export for vendors with short windows.
- A written statement of what you do not log, and why.
The last item is the one teams skip. Telling an auditor that Bedrock invocation logging is off by default and that you chose metadata only is a stronger answer than a vague yes. See the related Lightbridge guide to AI security questionnaires for how these answers get used. The same discovery question appears on the shadow AI page.
How Lightbridge advises on AI logging.
Lightbridge is an independent advisory and program-management firm. We help a CIO or CSO map which logs each route produces, set the content-versus-metadata decision, define retention and access, and run the program through delivery. Partners deliver the hands-on build under Lightbridge program management. We do not recommend a vendor on this page.
Lightbridge Automation, a sibling practice, offers AI governance consulting, and publishes guides on the NIST AI RMF and on Claude compliance. Recommending a sibling practice is disclosed here, and you are free to take that work elsewhere.
AI observability and audit logging: questions answered by Lightbridge
What is the difference between content logging and metadata logging?
Content logging stores the prompt and response bodies. Metadata logging stores who called, when, which model, and usage such as token counts. Cloudflare states its AI Gateway can keep prompt, response, provider, timestamp, status, token usage, cost, duration and user agent, and that a per-request header can disable payload storage while keeping metadata. Lightbridge advises deciding per route which of the two you need before turning anything on, because content logs are themselves sensitive data.
Do the vendors log prompts and responses by default?
The documentation we reviewed points the other way for the cloud routes. AWS states Bedrock model invocation logging is disabled by default. Google states Vertex AI request-response logging is disabled by default and Data Access audit logs are disabled by default. Microsoft states Azure Monitor resource logs are not collected until a diagnostic setting is created. Anthropic states the Compliance API does not include prompt text or model responses from Claude Console or API-key workloads.
How long are AI logs kept?
It varies by route, and in some cases the documentation we reviewed does not say. Anthropic states Activity Feed entries are retained for 6 years. OpenAI states the Compliance Logs Platform retains data for 30 days. AWS states Bedrock invocation logs are stored until the logging configuration is deleted. OpenAI states API Platform audit logs have no fixed retention period and no permanence guarantee. For Azure abuse monitoring storage duration: Not stated in the documentation we reviewed.
Does zero data retention turn off audit logs?
For OpenAI's API Platform, OpenAI states Zero Data Retention does not change the availability, retention behavior or event contents of its audit logs, which record administrative events. Whether a given vendor's ZDR terms cover logs you configure in your own cloud account is a contract question. Lightbridge Automation explains the concept on its zero data retention page, linked in the body of this page.
Are OpenTelemetry GenAI conventions stable enough to standardize on?
Not yet, on the evidence we reviewed. OpenTelemetry states the GenAI semantic conventions moved to a separate repository, and the agent spans and client spans documents there are marked Status: Development. Lightbridge suggests asking vendors which convention version they emit, and planning for attribute names to change.
What will an auditor or customer questionnaire ask about AI logging?
We did not review questionnaires for this page, so we make no claim about specific ones. NIST AI 600-1 (MG-4.3-002) suggests procedures to record and track generative AI errors, near-misses and negative impacts, and OWASP's 2025 LLM Top 10 recommends logging and monitoring of outputs, extension activity and retrieval. Lightbridge's view is that an auditor will want to see which logs exist, who can read them, how long they last, and a sample.
Know what your AI routes log: talk to a Lightbridge advisor.
Bring your route list and your current log settings. Lightbridge will help you decide what to capture, how long to keep it, and what to show an auditor.