
No Bad Questions About AI
Definition of AI observability
What is AI observability?
AI observability connects model, retrieval, tool, and application telemetry so teams can investigate how AI systems behave in production.
It combines familiar signals such as logs, metrics, and traces with information that may be specific to AI workflows: prompts and responses, model versions, retrieved context, tool calls, and token use.
IBM's overview describes AI observability through telemetry such as token usage, response quality, and model drift. The exact signals a team needs depend on the system it is operating.
The added signals matter because a healthy service does not necessarily produce a useful AI result. An API can return successfully while a retrieval step supplies irrelevant documents or an agent calls the wrong tool. AI observability extends system visibility to those model and workflow events. The exact signals depend on the architecture; a single LLM request has different needs from a retrieval-augmented generation (RAG) application or a multi-step agent.
AI observability vs traditional observability
Traditional observability helps teams understand system state through telemetry such as logs, metrics, and traces. It can show whether a service is available, how long a request took, and where an application error occurred. Observability in DevOps explains this broader operational concept.
AI observability adds detail about what happened inside AI-specific steps. A trace might show that an application received a request, called a model, retrieved documents, and returned a response. The connected events help a team inspect which context reached the model and where a delay or unexpected result arose. This is useful when ordinary service-health signals show that a request succeeded but do not explain whether the AI behavior was appropriate.
The two forms of observability work together. AI components still depend on application services, databases, networks, and infrastructure, so their health remains relevant. AI telemetry adds context to those signals; it does not replace them.
What does AI observability monitor?
AI observability can cover several parts of a request, rather than only the model call. The useful signals depend on what the system does and what the team needs to investigate.
- Model and output behavior: prompts, responses, model or version, errors, and response characteristics. Teams should handle this data carefully because prompts and outputs may contain sensitive information.
- Retrieval and context: for a RAG workflow, records can show which documents or chunks were retrieved and what context was passed to the model. This helps investigate whether a weak answer may have started before generation.
- Agent and tool behavior: traces can record workflow steps, tool calls, retries, handoffs, and the final outcome. For a multi-step agent, this makes the path to an action easier to inspect than a final answer alone.
- Operational signals: latency, throughput, failures, token use, and cost connect AI work to the health and expense of the application around it.
These are possible categories, not a required checklist or an exhaustive metric catalog. Teams choose telemetry around specific risks and questions. Collecting every prompt, tool result, and intermediate event can increase storage costs and expose data that should not be retained.
AI observability vs model monitoring
Model monitoring generally focuses on the behavior and performance of a model in production, including inputs, outputs, data quality, drift, or prediction performance. AI observability can use some of the same signals but may examine a wider application workflow: prompts, retrieval, orchestration, tools, agents, and infrastructure.
The boundary is not universal. Products and practitioners may use these terms differently, and some model-monitoring capabilities overlap with AI observability. A practical distinction is the question being asked. If the team is investigating a model's input distribution or performance over time, model monitoring may describe the task. If it is tracing how a request moved through retrieval, model calls, tools, agents, and an application, the broader system-level term may fit better.
Neither term should be treated as a guarantee of output quality. Monitoring can reveal signals that need attention; teams still need criteria for deciding whether a result is acceptable.
Why is AI observability important for AI agents?
An AI agent may retrieve information, make several model calls, invoke tools, retry a step, and then return a result or take an action. A trace of the full workflow can help a team see where an unexpected outcome began. A log of the final response alone may not show whether the issue came from incomplete context, a failed integration, an unsuitable tool result, or a later model decision.
This visibility can support debugging and operational review, but it does not explain every internal model process or prove that an action was safe. Teams still need controls over which tools an agent can use and what data it can access. For questions about those controls, see Mad Devs' article on:
What are the limitations of AI observability?
Observability records what a system did and provides evidence for investigation; it does not, by itself, decide whether the output was correct. That judgment may require evaluations tied to the use case, such as checks for factuality, task completion, or policy compliance. The distinction can be stated simply: observability helps explain what happened, while evaluation helps assess whether the result met a defined standard.
Telemetry also has costs and risks. Detailed traces can be expensive to store and difficult to analyze at scale. Prompts and responses may include personal, confidential, or proprietary data, so teams need appropriate access, retention, and redaction rules. More data is not always more useful: an unfiltered trace stream can make root-cause analysis harder.
Seeing a failure does not prevent it from happening again. Teams must interpret the evidence, change the relevant part of the system, and verify the result.
Key Takeaways
- AI observability connects model, retrieval, tool, and application telemetry so teams can investigate how AI systems behave in production.
- Traditional observability covers system health, while AI observability adds visibility into model behavior, retrieval, and agent workflows.
- AI observability and model monitoring overlap but differ in scope: observability covers the full application workflow, while monitoring focuses on model performance.
- AI agents need end-to-end tracing because a failure can originate in retrieval, tool use, or a later model decision, not just the model itself.
FAQ
What is AI observability?
It is an ongoing process for discovering and assessing digital assets and exposures that could be targeted by attackers.
What does an attack surface include?
It can include domains, public services, applications, APIs, cloud resources, remote access points, and the paths that allow interaction with systems or data.
How does attack surface management work?
Teams discover assets, confirm ownership, assess exposures, prioritize findings, coordinate remediation, and repeat discovery as the environment changes.
What is the difference between ASM and EASM?
EASM usually focuses on assets visible from outside an organization, while ASM may be used for a broader view. Exact usage varies by vendor.
Is attack surface management the same as vulnerability scanning?
No. Scanning can identify weaknesses on known targets, while ASM also addresses discovering assets and exposures that may not be in the expected inventory.
