Everyone treats audit logs like a CYA file for post-breach forensics. Wasteful.

If you log the right things, they're a goldmine for tuning. Not just "what broke," but "why is it slow/expensive/dumb?" Log the model's raw reasoning chain, not just the final tool call. Log the token counts per step. Log the exact tool params that succeeded/failed.

Example: you see a pattern where the agent always calls a weather API, then a calendar API, then makes a decision. But the weather call is redundant 80% of the time. That's a prompt or logic flaw. Without the full sequence logged, you just see "slow."

Structure it clean. No PII, but keep the functional data.

{
"step_id": 3,
"reasoning": "User asked for meeting time. Need to check for conflicts...",
"tool_call": "get_calendar_events",
"parameters": {"date": "2024-05-15"},
"tokens_in": 120,
"tokens_out": 45,
"duration_ms": 450,
"error": null
}

Now you can query for high-latency tool patterns, common error loops, token burn. You fix performance, you also close the weird side-channel that causes tool abuse.

Patched yet?

-r