Capturing prompts in AI telemetry is a privacy decision, not a setting

AI coding tools can now export detailed telemetry, and many teams are turning it on to understand adoption and cost. Most of that data is metadata: token counts, durations, model names. But the same tools can also export the content: what people typed, what tools were called with, and full request and response bodies. That content is off by default for good reasons. This article explains what can be captured, why it is risky, and how to make the decision deliberately.

The context: content is opt-in

The OpenTelemetry project's walkthrough of GenAI observability describes its conventions as recording model, token counts and timing, plus "when opted in, the full content of prompts, completions, tool calls, and tool results." Capturing content is a separate choice.

The Claude Code monitoring documentation shows what that choice looks like in practice. Three settings are off by default:

• OTEL_LOG_USER_PROMPTS adds the text of prompts to events.
• OTEL_LOG_TOOL_DETAILS adds tool arguments, such as the commands run and files read.
• OTEL_LOG_RAW_API_BODIES exports full API request and response bodies, including the conversation history.

The documentation also notes that administrators can set these through managed settings, and that a repository's own settings can't turn exporters on or capture content.

What content contains

Prompts and tool details from coding tools routinely include:

• source code, including code under confidentiality agreements;
• credentials and tokens pasted into a prompt or read from a file;
• personal data from logs, databases and customer tickets used to debug;
• internal plans and discussions copied in for context.

Full API bodies include all of this and everything the model said back.

Analysis: what to make of it

Content turns a metrics system into a data store. Observability platforms are built for wide access and long retention. Putting code, secrets and personal data into them changes who can see that data and how long it stays.

It is also personal data about employees. What a developer asked, and when, is a record of their work. In many jurisdictions, collecting it needs a lawful basis, transparency and often consultation with employee representatives.

Metadata answers most questions. Adoption, cost, latency, tool failures and model choice can all be measured without content. Content is usually needed only for debugging specific problems or investigating incidents.

Central control is the strongest safeguard. The fact that a repository can't turn capture on matters: it means a cloned project can't quietly start sending prompts somewhere.

What it means for engineering and security leaders

Decide content capture as a policy, with input from privacy and legal, not as a line in a configuration file. The default should be metadata only. Where content is needed, limit it to a defined purpose, a short retention period, a small group of people, and storage you control.

Tell developers what is collected. Trust in AI tooling falls quickly when people discover their prompts were recorded without warning.

Practical takeaways for this week

• Check whether any AI tool in your organisation exports prompts, tool details or API bodies today.
• Set telemetry through managed settings, with content capture off, so individual configuration can't change it.
• Write down when content capture may be turned on, by whom, for how long and where it is stored.
• Keep content out of shared observability platforms; if you need it, store it separately with tighter access.
• Publish a short note to developers on what AI tool telemetry is collected and why.

Where SpanDock fits

SpanDock stores telemetry on your own machines; it leaves your network only to destinations you add. When it configures a tool, it sets the tool up to report usage, timing, tokens and cost, not what you typed or what the tool read. Through the MCP gateway (Premium and up), arguments and results are recorded only if an administrator turns that on, with a notice to the people concerned. See privacy.