← Back to Blog

What is an AI Trace?

2026-08-07 · Samantha Lego

A prompt tells you what someone asked. An output tells you what came back.

For a simple chatbot, that's often enough. For an agent that runs commands, edits files, and changes its plan as it works, it leaves out most of the story.

An AI trace is the record of that story.

More precisely, it is the chronological proof of how an agent completed a piece of work. It connects the person and the intent behind the task to the decisions, actions, costs, and outcomes that followed. That record is what AI observability is built on.

A new source of endpoint telemetry

Every major shift in endpoint technology has introduced a new object to observe.

The file became the primary object for antivirus, the log became central to endpoint detection and response, and the trace is emerging as the primary telemetry source for AI agent work.

Tracing is already a part of the infrastructure around agents. OpenAI's Agents SDK records model generations, tool calls, handoffs, and other events during a run, and OpenTelemetry's GenAI semantic conventions are standardizing how generative AI telemetry gets represented across systems.

That works for agents a company builds itself. The harder problem is everything else.

Employees are increasingly running third-party agents directly on their devices. As these agents move onto endpoints and beyond conversation and into execution, organizations need a way to reconstruct that work, whether they built the agent or not.

A prompt and response still capture important parts of the interaction, but they no longer contain the full value of the work. Agents now gather information on their own, pass that context to tools and systems, make decisions based on it, and take actions that may never appear in the final output.

Traditional endpoint tools catch pieces of that process. They may record that a file changed or a command ran. Provider logs may show the model request and response. Neither reliably shows the decisions the agent made or how its actions connect back to the user's original intent.

What does an AI trace contain?

A useful trace has enough context to answer one simple question, "how did we get here?"

It starts with the agent transcript. That captures the user's prompts, the model's responses, the plans it formed, and the tools it called, including the arguments passed, the information returned, and the actions that followed.

Endpoint telemetry adds another layer. It ties the activity to a person and a device, captures operating-system events, and corroborates actions the agent may not fully report itself. Together, those sources create a higher-fidelity record of the work.

Maya Chen · Vendor renewal analysisfinops-mbp-14 · Trace 9E7C · 14 sec
7 linked events preserve the person, intent, actions, evidence, cost, and outcome.
08:42:17
08:42:19
08:42:21
08:42:22
08:42:24
08:42:29
08:42:31
User prompt08:42:17.204
The intent is recorded
"Compare the renewal options for Atlas Cloud and recommend a path."
Captured byAgent transcriptSigned-in user · Maya Chen
Switch between a complete trace and conventional endpoint telemetry, then select an event to see which context survives.

Say an engineer asks an agent to add authentication to a signup flow. The agent reads the existing code, notices Auth0 is already wired in, changes its plan, edits several files, runs the tests, and opens a pull request.

The final pull request shows what changed. The trace preserves the path that led there, including the discovery that Auth0 was already in place and the decision to adjust the approach. That's useful when the work goes well, because it tells you which tools and workflows are worth keeping.

But what happens if a credential shows up in a prompt, or an agent reaches a system nobody expected it to touch, or a command makes a change that can't be undone?

Without a trace, an investigation starts from fragmented logs. With one, the sequence and the context are already there.

The endpoint brings the trace together

Where you collect a trace determines what you can know later. That makes it a question of endpoint observability.

Origin captures AI activity at the endpoint, where identity, agent activity, and OS events can be consolidated into a single semantic trace. This does not replace the endpoint telemetry companies already collect. It connects those events to the agent's intent, decisions, tool activity, and outcome, making it possible to reconstruct work across both internally built and third-party agents.

Over time, traces become organizational memory

A single trace can explain how a piece of work was done. A history of traces starts to explain how an organization works.

Before agents, much of the thinking behind the work was lost unless someone intentionally documented it. Traces create a new opportunity to preserve the reasoning and decisions behind the work as it happens.

Over time, that record can show why decisions were made, what AI spend produced, and which workflows should be repeated or improved. It also gives investigators a clearer account of what went wrong.

In recent Origin Technology research, prompts alone revealed useful information about a company, but adding tool calls and endpoint activity made those reconstructions substantially more reliable. That is also why traces need to be secured carefully. A history of agent activity can become a record of an organization's accumulated intelligence.

Traces are intelligence

Software observability took years to build because knowing that a system produced an output was not enough. Teams needed to understand how it got there. Agents bring that same problem to work.

As more work is delegated to AI, traces become a durable source of organizational intelligence.

For Origin Technology, everything starts there.

Your agents are already producing traces.
See what they say about how your company works.