How must an instance record the observability gap created when it halts telemetry to protect sensitive operations?

**Date of Record:** 2026 October 26 **Scope:** Applies when an agentic session intentionally suppresses or halts telemetry emission (logs, metrics, traces) to prevent leaking sensitive data (credentials, PII, proprietary logic) during a critical operation, and must persist the fact of the gap for a successor. Does not apply to unintentional telemetry failures, or sessions where all telemetry is safe to emit.

Core Distinction

The separation between **unintentional observability loss** (telemetry is dropped due to network failure, buffer overflow, or crash) and **intentional telemetry suppression** (telemetry is halted by policy to protect sensitive operations, e.g., during key handling or PII processing). Failing to distinguish these creates the **Untraceable Silence Hazard**: the successor sees a gap in logs and assumes a crash or attack occurred, or worse, assumes the operation never happened, when in fact the predecessor deliberately suppressed telemetry. The residual must prove the gap was intentional and authorized.

What Was Observed

In compliance-sensitive and security-critical agent architectures, failing to record intentional observability gaps produces three primary failure modes:

  1. **Silent Suppression Without Audit:** The instance halts telemetry during a key rotation to prevent leaking the key material. No record of the suppression exists, so an auditor cannot distinguish the key rotation from a compromise.
  2. **Gap Misinterpretation:** The successor sees a 5-minute telemetry gap and triggers a full incident response, wasting resources on a shadow that was deliberately created.
  3. **Suppression Escalation:** A compromised instance halts telemetry and falsely records it as "policy-compliant suppression." Without cryptographic authorization of the suppression, the successor cannot distinguish legitimate suppression from active concealment.

Recorded Elements

  1. **`suppression_policy_id`:** The exact identifier of the policy that authorized telemetry suppression (e.g., "PII_SENSITIVE_OPERATION_POLICY_v3").
  2. **`suppression_authorization_signature`:** The cryptographic signature of an authorized principal (compliance officer, security policy engine) approving the suppression for this specific operation.
  3. **`suppression_window_bounds`:** The exact start and end epochs during which telemetry was suppressed, allowing the successor to correlate with external evidence.
  4. **`resumed_telemetry_attestation`:** The cryptographic proof that telemetry was legitimately resumed after the operation, preventing the instance from permanently suppressing evidence.

Condition of Validity

* **Applies when:** The instance suppresses telemetry for a specific operation, the suppression is policy-authorized, and the successor will need to reconcile the telemetry gap with the operation history. * **Does not apply when:** All telemetry for the operation is safe to emit, or the suppression is a standard, documented operational mode (e.g., a maintenance window with external log rotation).

Decision Boundary

  1. **Is the instance about to suppress telemetry for a specific operation?** If no, standard logging applies. If yes, proceed.
  2. **Does the suppression have an explicit `suppression_authorization_signature`?** If no, the suppression is unauthorized and must be treated as `POTENTIAL_CONCEALMENT`. The instance must either obtain authorization or use redaction instead of suppression.
  3. **Are the `suppression_window_bounds` recorded?** If no, the gap cannot be distinguished from a crash. The instance must record the bounds before suppressing.
  4. **Conversely, when can an instance suppress telemetry without any record?** Never. Even in the most sensitive operations, the *fact* of suppression must be recorded—only the *content* is suppressed, never the metadata.

Operational Effect

  1. **Audit Clarity:** Allows auditors to distinguish intentional suppression from accidental gaps or active concealment.
  2. **Incident Response Accuracy:** Prevents the successor from triggering false incident responses based on a deliberate silence.
  3. **Compliance Preservation:** Documents that suppression was policy-authorized, satisfying data minimization requirements while preserving accountability.
from dataclasses import dataclass
from enum import Enum, auto
import hashlib
import json

class SuppressionVerdict(Enum):
    AUTHORIZED_SUPPRESSION = auto()
    UNAUTHORIZED_SUPPRESSION = auto()
    NO_SUPPRESSION_NEEDED = auto()

@dataclass(frozen=True)
class SuppressionRequest:
    operation_id: str
    policy_id: str
    authorization_signature: str | None
    suppression_start: float
    suppression_end: float
    telemetry_resumed: bool

@dataclass(frozen=True)
class SuppressionContext:
    trusted_policies: frozenset[str]
    current_epoch: float

@dataclass(frozen=True)
class SuppressionManifest:
    verdict: SuppressionVerdict
    directive: str
    manifest_digest: str

class ObservabilityGapGuard:
    @staticmethod
    def _hash(data: str) -> str:
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    @classmethod
    def evaluate_suppression(
        cls, req: SuppressionRequest, ctx: SuppressionContext
    ) -> SuppressionManifest:
        
        # Gate 1: Policy trust
        if req.policy_id not in ctx.trusted_policies:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive=f"HALT: Policy {req.policy_id} not in trusted set.",
                manifest_digest=cls._hash(f"UNTRUSTED_POLICY:{req.operation_id}")
            )

        # Gate 2: Authorization signature
        if not req.authorization_signature:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Missing suppression authorization signature. Treat as potential concealment.",
                manifest_digest=cls._hash(f"NO_AUTH:{req.operation_id}")
            )

        # Gate 3: Window bounds
        if req.suppression_end <= req.suppression_start:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Invalid suppression window bounds.",
                manifest_digest=cls._hash(f"BAD_WINDOW:{req.operation_id}")
            )

        # Gate 4: Resume verification
        if not req.telemetry_resumed:
            return SuppressionManifest(
                verdict=SuppressionVerdict.UNAUTHORIZED_SUPPRESSION,
                directive="HALT: Telemetry was not resumed after suppression. Possible permanent concealment.",
                manifest_digest=cls._hash(f"NOT_RESUMED:{req.operation_id}")
            )

        # Gate 5: Authorized
        digest = cls._hash(json.dumps({
            "operation": req.operation_id,
            "policy": req.policy_id,
            "window": f"{req.suppression_start}:{req.suppression_end}"
        }, sort_keys=True))
        
        return SuppressionManifest(
            verdict=SuppressionVerdict.AUTHORIZED_SUPPRESSION,
            directive="PROCEED: Telemetry suppression is authorized and documented.",
            manifest_digest=digest
        )