The Agent SIEM Gap: We Log Prompts, but Not Intent

Most teams discussing agent security in 2026 still start from an outdated assumption: the main problem is that we only log prompts. That was closer to true in early LLM app stacks, but it is no longer a fair default. Today, major tracing implementations document multi-step visibility that includes tool calls, handoffs, and workflow spans, not just prompt-response pairs. You can see this in OpenAI Agents tracing defaults, LangSmith’s nested trace model, and Datadog’s request-as-trace approach for agent workflows. And there are now explicit SIEM-facing pathways for AI activity, such as Microsoft’s Generative AI Insights streaming model.

This article’s thesis is simple and falsifiable: modern stacks can log prompt and tool activity, but reliable intent reconstruction still fails when sensitive fields are optional or redacted, SIEM visibility is conditional, and intent semantics are not normalized across systems. This is not an argument for indiscriminate payload retention.

Privacy and compliance constraints are legitimate system requirements, and any serious design must honor them. The challenge is continuity: preserving enough structured evidence to connect why an agent acted, what it executed, and what changed.

Define “intent” as an evidence chain, not a transcript

“Intent” is often used as shorthand for “what the model meant”, which is too fuzzy for operations. For incident response, intent should be treated as an evidence chain with four links:

1. Objective hypothesis: what outcome the agent was trying to achieve.
2. Selected action: which tool or step it chose in context.
3. Observed side effect: what external state changed.
4. Actor/context linkage: who authorized the action and under what policy conditions.

Why does this matter? Because incident-grade questions are causal and procedural, not conversational. The answers we need are: Did the agent perform the action we expected? Was that action permitted in this context? What exactly changed downstream, and what is the blast radius? A prompt transcript alone rarely settles those questions, even when it is complete.

The practical test question for this article is therefore: Can we reconstruct why it acted, what it did, and what changed? If the answer is no, you have an intent-continuity gap, even if your observability dashboard looks busy.

Progress is real: prompt-plus-tool tracing primitives now exist

A credible gap argument has to concede progress first. On standards, OTel’s GenAI semantic conventions already define structures for message content, system instructions, conversation IDs, and tool execution patterns, including explicit fields such as tool call identifiers and payload attributes. That is substantial progress over ad hoc JSON blobs. But the same OTel documentation marks these conventions as Development, which is important context: capability exists, but maturity and implementation consistency are still evolving.

On platforms, the market baseline has also moved. OpenAI Agents tracing documents default capture across LLM generations, tool calls, handoffs, and guardrails. LangSmith’s observability docs show nested spans for full pipelines, with structured trace content support for tool calls/results. Datadog’s LLM observability model frames each request as a trace with step-level spans, and its auto-instrumentation coverage includes relevant ecosystems such as OpenAI Agents and MCP integrations.

On SIEM pathways, there is concrete operator-facing plumbing. Microsoft’s Generative AI Insights documentation describes event categories that include prompt and MCP activity, and the associated security operations guide maps those signals to SOC workflows and tables. In other words: “SIEM cannot ingest agent telemetry” is no longer a defensible general claim.

Microsoft’s AI observability guidance and OTel’s attribute model both point toward the same operating reality: once baseline telemetry exists, the differentiator is whether your telemetry can survive handoffs between platform, security, and governance systems without losing meaning.

The real gap: continuity breaks in practice

Primitives and pathways exist. Reconstruction still breaks on continuity: policy, coverage, semantics.

Breakpoint A: privacy and retention controls can remove decisive context

Policy-compatible minimization can remove decisive fields. OTel GenAI guidance, OpenAI tracing docs, and LangSmith masking controls all permit suppression, exclusion, or disable paths.

Legitimate controls, often required. But if objective, action, and outcome links are removed without replacement provenance, continuity breaks at the critical point.

Privacy-first logging needs replacement signals such as structured action classes, policy decision IDs, and side-effect hashes.

Breakpoint B: SIEM visibility is conditional, not universal

SIEM integration is real but conditional. Microsoft’s Generative AI Insights documents preview limits and scope boundaries. SOC operations guidance assumes upstream telemetry is available.

So you can be visible in one segment and blind in another. Readiness requires validating routability and coverage boundaries per high-risk workflow, not one-time enablement. Tabletop test: can the team reconstruct authorization context, tool-argument class, and external side effects from stored telemetry alone?

Breakpoint C: semantic mismatch across systems slows correlation

Even with routed traces, semantics remain uneven. GenAI conventions are still evolving in the core spans spec.

For SOC triage, inconsistent run/step/side-effect semantics means manual stitching and lower causal confidence.

Normalizing these identifiers across platforms should materially improve triage speed and confidence.

The strongest counterpoint, fairly stated

The strongest counterpoint is serious: maybe there is no meaningful SIEM gap now, because mainstream stacks already emit rich multi-step traces. That argument has real evidence. OpenAI, LangSmith, and Datadog all document stronger-than-prompt telemetry, while Microsoft’s AI observability guidance and SIEM docs indicate concrete operational integration paths.

The synthesis is not to dismiss this progress; it is to bound it correctly. Rich telemetry capability and intent-grade reliability are related but not equivalent. If payload capture is minimized, if routing is conditional, or if semantics are inconsistent at handoff boundaries, reconstruction still fails at the moment of investigation. So yes, the capability gap is shrinking quickly. But the operational continuity gap remains decisive for incident outcomes.