Logging & Telemetry
What every authenticated action records: telemetry, security alerts, audit.
Logging & Telemetry is the observability substrate under every authenticated action. Three things happen on each request, and they serve three different readers.
Telemetry
Every authenticated request emits a telemetry event: who, what, when, where, and how, as metadata, never the content itself. This is what powers the cost and activity views in the Tower and lets an operator watch the fleet without exposing member data.
Security alerts
Detection rules fire on the telemetry stream: impossible travel, request bursts, credential sharing, the patterns that signal a key or agent behaving unlike its baseline. Because every connection has a per-key baseline from the Grid, anomalies are cheap to spot and act on, up to and including the kill-switch.
Audit
Separate from telemetry, the audit log is the examiner's record: append-only, hashed, with the retention NCUA examinations require (five to seven years) and export on demand. Telemetry is for running the system; audit is for proving it ran correctly. The two are kept distinct on purpose.