Prompt Logs API.
Version the instructions. Protect the content.

Record how a prompt was assembled

A prompt manifest describes the configuration and input classes used to assemble an interaction. It can reference an immutable template version, retrieval settings, and an output contract. Those references let reviewers compare behavior across changes without retaining the actual user message or retrieved document in routine logs.

Decide which configuration changes require a new version. Instruction changes, variable definitions, and assembly order may matter independently. If retrieval configuration evolves separately from the template, give it a separate reference. Keep mutable aliases distinguishable from the immutable versions they resolved to during execution.

Give content selection a clear boundary

Begin with an allowlist of metadata needed for specific investigations. Content capture should have a defined purpose, scope, access policy, and lifetime. Review the earliest point where a log, queue, error report, or console could retain the assembled material. Redaction at a later destination cannot remove a copy that was already written upstream.

Record the active redaction-policy version and whether capture was disabled, allowed, or suppressed by a failure. Use a safe failure code when processing cannot complete. A fallback that logs the original payload defeats the collection boundary precisely when the system is behaving unexpectedly.

Validate usefulness as well as privacy

Use fictional test inputs to confirm that protected values stay absent throughout the export path. Include nested objects, malformed input, exceptions, and multiline text. Then check that the remaining event can still explain the relevant assembly or validation result. An empty record may protect content while losing the evidence needed for the investigation.

Read the complete prompt logging guide for manifests, access controls, and evaluation references. The fields below are recommended application conventions and should be adapted to the configuration system that owns the prompt.