Multi-tenant agent telemetry needs an enforced tenant context before data reaches shared processors or exporters. Never trust a tenant identifier supplied only by the instrumented workload.
Collector path
- Authenticate the workload and derive tenant, workspace, service, and environment from trusted deployment metadata.
- Reject or overwrite conflicting client-supplied boundary fields.
- Apply content redaction and attribute allowlists before shared storage.
- Enforce per-tenant rate, memory, queue, and export limits.
- Route to tenant-approved regions and destinations.
Cardinality and sampling
Keep tenant, workflow, agent version, operation, model, tool, status, and risk tier queryable. Store session and request identifiers for correlation but do not use them as unbounded metric dimensions. Tail-sample errors, denied actions, high-impact tools, fallbacks, and slow traces; retain a controlled baseline of successful runs.
Failure behavior
Monitor dropped spans, queue saturation, exporter errors, clock skew, and missing sequence intervals by tenant. High-impact actions should fail closed or enter an approved degraded mode when mandatory evidence cannot be written.
Isolation test
Attempt cross-tenant queries and exports, flood one tenant, inject forged resource attributes, and capture sensitive tool arguments. Verify isolation, fairness, redaction, and visible gap alerts.