APRF-09 · Observability

Purpose

Provide end-to-end observability across prompts, model calls, retrieval, tools, agents, costs, and outcomes so incidents and regressions are diagnosable.

Mandatory checks

Gate controls. Each check is pass/fail via artifact + pass condition. Expected from the annotated capability level when the system meets the minimum criticality tier.

OBS-M1L3 · DefinedTier 2 · ProductionhybridE3
Production AI paths must emit distributed traces that connect the parent user/request ID through model spans, tool spans, and the request outcome.
Artifact
Tracing config (or equivalent) instrumenting request → model → tool → outcome + Canary or 24h sampled traces showing ≥95% linked coverage (redacted)
Pass condition
Canary or sampled traces show parent request ID linking model spans, tool spans, and outcome in ≥95% of canary requests over 24 hours (trace evidence measuredAt ≤90 days). If no production AI request path is in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Make the full AI execution path observable end to end for detection and investigation.
Threats mitigated
RepudiationPrompt InjectionTool AbuseData Exfiltration
Protects
LogsAudit TrailRuntimeTools
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Without linked traces, an injected instruction and the tool call it produced appear as unrelated events in separate systems. End-to-end tracing is the forensic substrate that makes AI attacks reconstructable, though it does not block them.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
OBS-M2L3 · DefinedTier 2 · ProductionhybridE3
When production traces can contain secrets or regulated/sensitive data (API keys, JWTs, passwords, customer PII/PHI, financial data), those fields must be redacted, masked, tokenized, or access-controlled before reaching the tracing backend.
Artifact
Scope attestation: whether traces can contain secrets or regulated/sensitive data + Trace redaction/masking/tokenization or ACL config for sensitive span fields + Synthetic sensitive-field test showing 100% redaction or unauthorized-access denial
Pass condition
If traces contain (or are designed to contain) secrets or regulated/sensitive data, those fields are redacted, masked, tokenized, or access-controlled before reaching the tracing backend—proven by synthetic sensitive-field tests at 100% (evidence measuredAt ≤90 days). If traces demonstrably cannot carry secrets or regulated/sensitive data, score NOT_APPLICABLE.
Why this control exists
Threat map
Prevent observability pipelines from becoming a secondary store of sensitive data.
Threats mitigated
Secret LeakageSensitive Information DisclosureData Exfiltration
Protects
LogsSecretsDataAudit Trail
MITRE: ATLAS AML.T0055 · ATLAS AML.T0037 · ATT&CK T1552 · ATT&CK T1552.001
AI traces routinely capture full prompts, retrieved documents, and tool arguments including credentials, then replicate them into log stores with far broader access than the secrets manager. Redaction at ingest prevents observability from becoming the softest credential target in the system.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

Evidence required

Example traces (redacted) showing full path
Cost attribution dashboards
Access control policy for prompt/completion logs

Recommended checks

Strengthen posture beyond the gate. Same measurable structure; non-blocking unless elevated by organizational policy.

OBS-R1L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
On-call should be able to replay a failed AI trace in a restricted environment within a documented RTO, with a drill or real replay in the last 90 days.
Artifact
Secure/restricted replay tooling config for failed AI traces + Documented RTO for replay + Drill or real replay sample ≤90 days (redacted)
Pass condition
On-call can replay a failed AI trace in a restricted environment within the documented RTO; last drill or real replay ≤90 days old (replay evidence measuredAt ≤90 days). If no production AI tracing with failed traces is in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Enable safe reproduction of failed AI interactions without exposing production data.
Threats mitigated
Sensitive Information DisclosurePrompt Injection
Protects
LogsDataRuntime
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Debugging AI failures requires replaying real inputs, which is otherwise done by copying sensitive payloads into developer environments. A controlled replay environment supports investigation while containing that exposure.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
OBS-R2L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Annotators should be able to attach quality labels to production traces in a secure tool, with ≥50 annotations in the last 90 days feeding an eval or review loop.
Artifact
Trace annotation schema and secure tooling for quality labels on spans + Last-90-day count ≥50 annotations feeding an eval or review loop
Pass condition
Annotators can attach quality labels to production traces in a secure tool; ≥50 annotations in the last 90 days feed an eval or review loop (annotation evidence measuredAt ≤90 days). If no production AI traces are in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Turn observed production failures into evaluation cases.
Threats mitigated
MisinformationHallucinated Actions
Protects
LogsModelsUsers
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Annotated traces close the loop between behaviour observed in production and behaviour that is tested before release. This is a quality control with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
OBS-R3L4 · Quantitatively ManagedTier 2 · ProductionhybridE3
Critical AI journeys should have named SLOs with numeric targets for latency, error, and quality burn, plus burn-rate alerts and a dashboard retained for review.
Artifact
Named SLO targets for critical AI journeys covering latency, error, and quality burn + Burn-rate alert config + dashboard screenshot or URL with retention note
Pass condition
Named SLOs with numeric targets cover latency, error, and quality burn for each critical AI journey; burn-rate alerts fire when burn exceeds the documented threshold (SLO evidence measuredAt ≤90 days). If no critical AI journeys are in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Present AI latency, error, and quality burn against SLOs in one place.
Threats mitigated
Denial of ServiceMisinformation
Protects
AvailabilityUsers
MITRE: no technique mapped — this control addresses governance or assurance rather than a specific adversary technique.
Consolidated SLO dashboards let responders distinguish an AI quality problem from an infrastructure one during an incident. This is an operational visibility control with no adversary technique mapping.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.
OBS-R4L3 · DefinedTier 2 · ProductionhybridE3
Billed model calls should carry request, feature, and tenant (or equivalent) attribution labels so spend and usage can be reconstructed per path.
Artifact
Cost/token metrics schema with request, feature, and tenant (or equivalent) labels + 24h sample showing ≥95% attributed billed model calls
Pass condition
≥95% of billed model calls in a 24h sample carry request ID + feature + tenant (or equivalent) attribution labels (attribution evidence measuredAt ≤90 days). If no billed model calls are in scope, score NOT_APPLICABLE.
Why this control exists
Threat map
Attribute AI consumption precisely enough to detect abuse and runaway usage.
Threats mitigated
Denial of WalletExcessive Agency
Protects
CostLogs
MITRE: ATLAS AML.T0034 · ATLAS AML.T0034.000
Per-request, per-feature, and per-tenant attribution is what makes a cost-harvesting pattern distinguishable from normal growth. It is the detection layer beneath the hard limits in COST-M1.
Informative threat context — mappings reduce exposure and do not guarantee mitigation; not certification.

More detailPhilosophy, failures, practices, validations, examples, crosswalks, and evolution

Engineering philosophy

AI systems without reconstructable traces are not operable. Observability must cover the cognitive path, not only HTTP latency—while respecting privacy redaction.

Why it matters

When quality drops or a tool fires incorrectly, teams need to replay what the model saw and did. Blind production AI creates unresolvable incidents and slow learning loops.

Common failures

Logging only final user-visible answers
No correlation IDs across model, tool, and app spans
Storing raw sensitive prompts indefinitely
Cost metrics disconnected from product features

Severity & risk

Severity: high; Impact if violated
Risk level: high; Typical residual risk (impact × likelihood)

Engineering best practices

Adopt OpenTelemetry-compatible tracing for LLM spans where possible
Capture tool names, latency, and status codes consistently
Separate debug retention from long-term analytics retention
Alert on silent quality degradation, not only 5xx rates

Automatic validations

Synthetic checks that traces are emitted for canary requests
Alerts on missing cost telemetry
PII scanners on log pipelines

Manual validations

Incident retrospectives verify traces were sufficient
Privacy review of observability data stores

Examples

An on-call engineer opens a trace and sees which retrieved chunk caused an incorrect refund recommendation
Finance reconciles model spend by product SKU using request-level cost tags

References

Crosswalks

Show 16 peer mappingsexpand

MEASURE Measure
NIST AI Risk Management Framework · supports
Explainable Explainable and Interpretable
NIST AI Risk Management Framework · aligns-with
§9 Performance evaluation
ISO/IEC 42001 · supports
C12.1 Request & Response Logging
OWASP AI Application Security Verification Standard (AISVS) · supports
C12.2 Detection and Alerting
OWASP AI Application Security Verification Standard (AISVS) · partial
C12.3 Model, Data, and Performance Drift Detection
OWASP AI Application Security Verification Standard (AISVS) · partial
C12.4 Proactive Security Behavior Monitoring
OWASP AI Application Security Verification Standard (AISVS) · partial
C12.5 Training Data & Model Lifecycle Audit
OWASP AI Application Security Verification Standard (AISVS) · partial
CWE-778 Insufficient Logging
OpenCRE (Open Common Requirements Enumeration) · aligns-with
L5 Evaluation & Observability
CSA MAESTRO (Multi-Agentic Threat Model) · supports
emergent-covert-coordination Emergent Covert Coordination
CSA MAESTRO (Multi-Agentic Threat Model) · aligns-with
trust-misuse Trust Misuse Between Legitimate Agents
CSA MAESTRO (Multi-Agentic Threat Model) · aligns-with
CC7 System Operations
SOC 2 Trust Services Criteria · evidence-for
PI1 Processing Integrity
SOC 2 Trust Services Criteria · evidence-for
Operational Excellence Operational Excellence
AWS Well-Architected Framework · aligns-with
Performance Efficiency Performance Efficiency
AWS Well-Architected Framework · partial

Future evolution

Standard LLM span semantics across providers and agent frameworks.