Your Agent Transcripts Are Discoverable, and Legal Never Signed Off

You instrumented your agent the way every observability guide told you to. Every turn gets a span: the full prompt, the retrieved chunks, the model's chain of thought, the tool calls it considered, the plan it drafted and then abandoned, the final action. Storage is three cents a gigabyte and the traces have saved you a dozen times during incident response. You kept everything because keeping everything was free and occasionally heroic.

Here is the part nobody on the platform team modeled: that trace is written in fluent English, it speculates about your customers by name, and it drafts actions you never actually took. It is the single most quotable artifact your company produces, and a plaintiff's attorney will read the juiciest 200 words of it to a jury with your logo on the slide behind them. The reasoning trace that makes your system debuggable is the same reasoning trace that makes it liable.

This is not a hypothetical about some future regulatory regime. Courts have already decided the category question. In 2025 and 2026, judges compelled production of millions of generative-AI logs — prompts and model outputs — on the straightforward theory that they are electronically stored information like any email or Slack message. The novelty of the data source buys you nothing under the discovery rules. If a log is relevant to a claim or defense and producing it is proportional to the case, it comes out. "It's just a model debug trace" is not a category the Federal Rules recognize.

Why a Reasoning Trace Is Worse Than a Log Line

Traditional application logs are terse and mechanical: a status code, a latency, a stack trace. They are boring, which is exactly why they are safe. A jury falls asleep reading 500 Internal Server Error. Nobody's intent is legible in a heap dump.

Agent transcripts are the opposite. The model was fine-tuned to produce text that reads like a thoughtful human deliberating, because that is what makes it useful and what makes chain-of-thought improve answers. So your logs are now full of first-person prose that sounds like a person weighing options, forming opinions about a user, and choosing a course of action. That readability is a debugging superpower and a courtroom catastrophe.

Consider the specific failure mode of a discarded plan. Your agent, mid-reasoning, writes: "The customer is likely trying to exploit the refund policy; I could deny the claim and flag the account, but that may violate the fairness guidelines, so instead I will escalate to a human." You are proud of that trace. It shows the guardrail working. The model considered a bad action and correctly rejected it.

Now read it the way opposing counsel will: your system concluded the customer was an exploiter and contemplated denying them before backing off. The rejected branch, stripped of the sentence that rejected it, reads as premeditation. In your incident tooling the abandoned plan is evidence of safety. On a courtroom projector it is evidence of intent. The trace does not carry its own context, and cross-examination is the art of removing context.

This is the uncomfortable inversion at the center of agent observability: the artifact you value most for debugging — the model's uncensored deliberation — is the artifact you'd least want read aloud under oath.

Don't Count on Privilege to Save It

The instinct among engineers is to assume some legal shield covers this. It largely does not.

Attorney-client privilege protects communications with a licensed lawyer for the purpose of legal advice. A model is not a licensed professional, the conversation was not directed by your counsel, and the provider's terms typically reserve the right to share data with third parties. Courts that have looked at consumer AI chat logs have declined to extend privilege to them on exactly those grounds. Enterprise deployments with real confidentiality contracts and counsel-directed use might be treated differently, but that is a bet you make deliberately with your legal team, not a default you inherit by using an API.

Work-product protection is a little more promising — it covers materials prepared in anticipation of litigation — but almost none of your production agent traffic is prepared in anticipation of litigation. It's prepared in anticipation of answering a support ticket. The doctrine does not stretch to cover your entire event stream just because some fraction of it might someday matter in a lawsuit.

The practical takeaway: assume every reasoning trace you retain is producible. Design as if there is no shield, because for the bulk of your logs there isn't one.

Retention Is the Only Lever You Actually Control

You can't make a produced document disappear once litigation is anticipated — that's spoliation, and the sanctions for it (adverse-inference instructions, where the judge tells the jury to assume the deleted evidence was bad for you) are far worse than the document ever would have been. The legal hold is a hard override: the moment litigation is reasonably foreseeable, your normal deletion schedule freezes for anything relevant.

But before a hold attaches, retention is entirely your decision, and most teams have made it by accident. "Keep everything forever" is not a policy; it's the absence of one. The single highest-leverage move is to set a real, short, and — critically — consistently enforced retention schedule, so that when a trace expires, it expires because of a routine policy applied to everyone, not because you selectively reached in and deleted it after you smelled a lawsuit.

Rough numbers that have emerged as defensible practice:

• Operational tool-call and audit ledgers: 12 months or more. This is the record of what your agent actually did — the API calls, the state changes, the money moved. You want this; it's also what proves you exercised reasonable care.
• Prompts and final responses: 90 days to a year for general enterprise use. Long enough to debug and evaluate, short enough to limit exposure.
• Regulated workloads (finance, healthcare): three to seven years, aligned to the records schedule you already have to keep anyway.
• The raw deliberation — chain of thought, rejected branches, intermediate scratchpads: the shortest window you can operationally tolerate.

The consistency matters more than the exact number. A 90-day schedule that you actually run beats a 30-day policy you enforce only when it's convenient, because the latter looks like evidence-destruction the moment a court examines the pattern.

Tier the Trace: Keep the Ledger, Expire the Deliberation

The design principle that resolves the tension is to stop treating "the agent trace" as one undifferentiated blob and split it by its dual purpose. Two very different things are tangled together in your current spans:

1. The action ledger — what the agent did, who initiated it, which model version and prompt template ran, which tools fired with which arguments, what changed in the world. This is your defense. It proves the system had spend limits, honored reversibility tiers, and escalated the irreversible to a human. It's structured, low-prose, and you want to keep it a long time.
2. The deliberation — the free-text reasoning, the speculation about the user, the roads not taken. This is your debugging gold and your legal liability, and it decays in usefulness fast. A rejected plan from eight months ago has almost no debugging value and enormous discovery value.

Log them into separate stores with separate retention clocks. Let the ledger live for a year or more. Let the raw deliberation expire in weeks. When you do need the reasoning for a live incident, you promote a specific trace out of the short-retention store into a case file — a deliberate, logged act — rather than passively hoarding everyone's chain of thought forever.

Then reduce what you write in the first place. The OpenTelemetry GenAI conventions that standardized agent tracing in late 2025 make full prompt-and-completion capture a toggle precisely because the maintainers know it's a governance hazard. Before you flip it on globally:

• Redact at write time. Strip or tokenize customer names, account numbers, and PII before the span is persisted, not in some cleanup job that runs later and misses things.
• Sample the verbose stuff. You do not need the full reasoning trace for 100% of successful requests. Capture it richly on errors and on a small random sample; keep only structured metadata for the happy path.
• Store zero when you can. For your highest-risk flows, a zero-data-retention API tier means the deliberation never lands in your systems at all, which is the one form of data that is truly un-subpoenable.

The Question Worth Asking Before the Subpoena

Here is the trade every platform team is making without noticing: richer traces mean faster incident resolution and larger legal surface area, and those two curves move together. There is no free zone where you get maximum observability and minimum liability. The teams that will look smart in two years are the ones that priced both sides of that trade on purpose instead of optimizing only the debugging side because it was the only one with a dashboard.

So before your next agent ships, ask the question your observability guide skipped: if a hostile attorney had to read this trace to a jury, what did we write that we did not need to keep? Then log accordingly — the ledger long, the deliberation short, the PII never. Your most useful observability artifact and your largest legal liability are the same file. The only real decision is how long you leave it lying around.