What logging should enterprises require from AI coding assistants?

Require enough to reconstruct a session end to end: who ran it, what entered the context, every tool call and its arguments, every file read and write, every shell command, every network destination, and every approval decision. Most vendor logging captures usage volume and stops there, which answers billing questions and no security questions.

The specific fields worth mandating in a procurement or configuration standard:

Identity and session. Human user, agent session ID, workstation, repository, timestamp.

Context provenance. Which files, issues, documentation, and MCP tool descriptions entered the context window, so an injection can be traced to its source file.

Tool invocations. Tool name, full arguments, result status, and the MCP server that served it.

Filesystem activity. Reads and writes with paths, flagged when they touch credential or configuration paths.

Shell execution. Full command string, exit code, working directory.

Network activity. Destination host for every outbound request the agent initiated.

Model metadata. Provider, model name, version, and any system prompt or rules file applied.

Approvals. What was prompted, what the human chose, and how long they took.

Code provenance. Which committed lines originated from the agent.

Ship all of it to your SIEM rather than leaving it in vendor consoles, and set retention to match your incident investigation window rather than the vendor default.

Akto Atlas centralizes this telemetry across coding assistants, correlating agent sessions with the repositories, credentials, and MCP servers they touched.

The test of adequate logging: after an incident, can you name the file that carried the injected instruction? If not, the logging is billing telemetry.