AI Observability
Control Core separates compliance audit from AI engineering observability:
| Path | Required? | Purpose |
|---|---|---|
| Control Plane audit APIs + SIEM outbox | Yes for compliance | Immutable allow/deny/redact decisions |
| Langfuse (self-hosted) | No — opt-in | Multi-turn LLM traces, prompt versions, evals |
| Grafana / Loki | No — opt-in | Platform metrics and diagnostic logs |
AI Observability in this guide means optional Langfuse traces emitted by the Bouncer over OpenTelemetry (OTLP/gRPC) when AI traffic passes through Bouncer intercept. PBAC enforcement does not depend on Langfuse; if Langfuse is down, inline Rego decisions continue.
How traces flow
Click to enlarge
Span attributes include controlcore.decision, controlcore.rule_matched, controlcore.pii_detected, controlcore.spiffe_id, and controlcore.deployment_mode (enforce vs shadow).
Enable Bouncer OTEL (~5 min)
Set on each protecting Bouncer:
CC_OTEL_ENABLED=true
CC_OTLP_ENDPOINT=langfuse.<namespace>.svc:4317 # or collector → Langfuse
Recreate or restart the Bouncer pod/container after changing env vars.
Troubleshooting: If no spans appear in Langfuse, verify
CC_OTEL_ENABLED=true, OTLP port 4317 reachability, and that test traffic actually traversed AIBouncer intercept. Health:curl -fsS http://<langfuse-host>/api/public/health. See Langfuse setup.
Air-gap and sovereignty
For disconnected or sovereign deployments:
TELEMETRY_ENABLED=false— no Langfuse product telemetry phone-homeLANGFUSE_TELEMETRY_ENABLED=false— disable Langfuse worker telemetryglobal.zeroForeignEgress=true— keep observability inside your boundary (Helm)
Langfuse and the Bouncer OTLP exporter must target in-cluster endpoints only.
Shadow mode debugging
With BOUNCER_ENFORCEMENT_MODE=shadow, live traffic pass-through continues while spans may tag controlcore.decision=WOULD_DENY with controlcore.rule_matched. AI developers inspect policy impact without blocking users.
Full setup guide
The step-by-step Langfuse install (Helm, Compose, bootstrap project script, filter attributes) lives in the dedicated setup page:
Next steps
- AI audit events — immutable SIEM event catalog
- Grafana setup — optional platform hub
- AI Gateway — configure routes before tracing
- How logging works — audit vs diagnostic separation