What the prompt asks for
The usage-audit prompt asks an agent to record a task ID, action ID, timestamps, action type, target, outgoing and incoming data, total, evidence source, outcome, retries, and privacy level. It also keeps model-token usage separate from network data.
“Financial file upload · 4.2 MB · category: financial · source: file metadata · approval: granted.”
Not the full file contents. Not a copied credential. Enough context to understand the action and its impact.
What not to retain
- Passwords, session cookies, access tokens, API keys, and payment credentials.
- Full personal, financial, medical, or private message content when category and size are enough.
- Raw HAR files, screenshots, or exports with unredacted connected-account data.
Your control points
Ask before sign-in, account connection, upload, download over a limit, form submission, purchase, setting change, or sensitive disclosure. If a source cannot report bytes, the ledger should say Unavailable rather than inventing precision.
Scope: This is project guidance, not legal advice. Review the policy and provider terms that apply to your own deployment.