Observability
Zero-instrumentation audit logging and OTEL export. Every agent operation is automatically captured with cryptographic integrity—no code changes required.
The Problem
Observability is critical for enterprise AI—forensics, provenance, audit trails, compliance. Today, DIY instrumentation is the only option: labor-intensive, ad-hoc, and lacking end-to-end visibility across the trust mesh.
Without MACAW
- • Manual instrumentation in every service
- • No correlation across agent boundaries
- • Logs lack cryptographic proof
- • Compliance audits are painful
With MACAW
- • Automatic capture at every endpoint
- • Correlated across the mesh by request
- • Cryptographically signed audit trail
- • Export to your existing stack
Two Log Streams
MACAW maintains two separate log streams, each optimized for different use cases:
Events Log
Operational source of truth. High-volume, real-time visibility into system behavior.
- • Tool invocations
- • Policy evaluations
- • Agent registration/deregistration
- • Prompt lifecycle events
Audit Log
Compliance-critical record with cryptographic signatures. Tamper-evident and forensically verifiable.
- • Signed with agent's private key
- • Hash-chained for deletion detection
- • Regulatory-grade retention
- • SIEM integration ready
Audit Signing Modes
Choose the signing mode that matches your compliance requirements. Configure via the Console.
| Mode | Security | Use Case |
|---|---|---|
| plain | None | Development, testing |
| signed | Per-event Ed25519 | Tamper-evident, forensically verifiable |
| crypto | Hash chain + signature | Deletion/insertion detectable |
| blockchain | Merkle tree anchoring | Third-party attestation, regulatory |
OTEL Export
Export telemetry to your existing observability stack via OpenTelemetry. Configure destinations in the Console—no code changes needed.
Multiple destinations can be configured simultaneously, each with its own endpoint, authentication, and filtering rules.
| Backend | Protocol |
|---|---|
| Datadog | OTLP/HTTP |
| Splunk | OTLP/HTTP |
| Grafana / Tempo | OTLP/gRPC |
| Jaeger | OTLP/gRPC |
| New Relic | OTLP/HTTP |
| Custom OTLP | gRPC or HTTP |
Event Export & Correlation
Every operation emits a structured event carrying the IDs that link it back to the originating request — across agents, tools, and LLM calls. MACAW exports the raw event stream over OTLP. Your observability platform decides how to model it.
- •Correlation IDs on every event — invocation, prompt lineage, workflow
- •Policy decision and matched policy recorded with each authorization
- •Raw OTLP export — model as spans, logs, or metrics in your stack
- •Per-tenant isolation preserved end to end
Request Flow (correlated by invocation_id):
User → Agent A → Tool X → LLM
│ │ │
▼ ▼ ▼
[event] [event] [event]
│ │ │
└─────────┴───────┘
│
invocation_id: inv-abc123
Each event includes:
• caller, resource, operation
• policy decision + matched policy
• signature verification result
• timestamp and outcomeCustom Events
Add application-specific events to the same log streams using the SDK. Custom events are signed with your agent's key and included in the audit trail.
from macaw_client import MACAWClient
client = MACAWClient(app_name="my-app")
client.register()
# Log a custom event (signed and audit-logged)
client.log_event(
event_type="user_action",
data={"action": "export_report", "format": "pdf"}
)
# Events appear in both streams with your identity