The full lifecycle of a request: request metadata, the assembled prompt, model configuration, retrieval details for RAG, the final response, every tool call for agents, safety signals, cost and latency, and user/evaluator feedback — while keeping privacy in mind for anything sensitive.

Request-level logs cover request ID, session/conversation ID, timestamp, environment, and the user query — the request ID matters most because it ties every downstream trace back to one interaction. Prompt logs capture the system prompt version, user prompt, any conversation summary used, retrieved context inserted, template version, and the final assembled prompt — without this, debugging a behavior change is close to impossible because you can't tell what the model actually saw. Model logs record model name/version, provider, temperature, top-p, max tokens, stop sequences, and seed if supported, since a model version bump alone can silently change output for an identical prompt. RAG logs need embedding model version, vector index version, the (possibly rewritten) query, top-k chunk and document IDs, chunk scores, metadata filters, reranker scores, and the final context passed to the LLM — this is what lets you answer "did we retrieve the right documents" after the fact instead of guessing. Response logs capture the final answer, citations, structured output, finish reason, and output token count — finish_reason=length specifically tells you the model was cut off by the token limit, not that it finished naturally. Tool/agent logs record every tool call's name, input, output, latency, errors, retries, and approval status, plus total steps and termination reason, since agent failures are otherwise nearly undebuggable. Safety logs capture prompt injection flags, unsafe content flags, PII detection, policy violations, and blocked tool calls. Cost and latency logs track input/output/total tokens, per-stage latency (model, retrieval, tool), total latency, cost per request, and cache hit/miss. Feedback logs capture thumbs up/down, human review labels, and scores like correctness, faithfulness, and relevance, which become the data for continuous improvement. Cutting across all of it: don't log blindly — mask, redact, encrypt, and apply access control and retention policies to anything that touches passwords, API keys, personal data, financial data, health data, or confidential documents.