Is it safe to let a coding agent near this data?

A connection acts as the person who approved it and never exceeds that person's role. They tick which capabilities it may use, nothing it can do deletes anything, and every change is attributed in the audit trail.

How does it authenticate?

Through the browser, as a person, so there is no long-lived token pasted into a config file for someone to find later.

Can we see what it did?

Yes. Every action is attributed to the connection and the person behind it, in the same audit trail as the rest of the tenant.

What happens when someone leaves?

The connection inherits their role, so removing their access removes the agent's. There is no separate service identity to remember to clean up.

Your coding agent,reading the sametelemetry you do.

Connect Claude Code, Codex or Cursor and the agent queries metrics, logs and traces the way you do. There is no API key involved, it never exceeds the role of the person who approved it, nothing it can do deletes anything, and every change lands in the audit trail.

Start free→Read the docs

insight / ai tool telemetryLIVE

why did checkout p95 jump at 14:20?

INFOreading checkout p95 over the last 6 hoursstep 1 of 4

INFOp95 2.14 s, up from 640 ms at 14:19step 2 of 4

WARNchat gpt-4o span is 78% of the requeststep 3 of 4

INFOfinish_reason=length on 142 calls this hourstep 4 of 4

The agent runs the queries itself, signed in as itself, inside the role you gave it.

Clients that connectTrademarks →

What you get

Included on every plan, including the free tier.

Metrics, logs and traces queryable by the agent, so an investigation starts from real data rather than a pasted snippet.

A connection that acts as the person who approved it and never exceeds that person's role.

Capability groups you tick per connection, so an agent gets the access the task needs.

Nothing destructive in reach, and every change attributed in the audit trail.

How it gets there

Three steps, then you can just ask.

01Add the connection from the portal and sign in through the browser.

02Tick the capability groups the agent may use.

03Ask your coding agent about your telemetry in its own chat.

What you can ask

What you would actually type.

PROMPT

why is checkout p95 up since the deploy?

It reads the metrics and the traces itself.

PROMPT

find the error in payments-api this hour

Logs, filtered to the window that matters.

PROMPT

which label is growing our series count?

Cardinality answered from your own tenant.

Related use cases

Agent observabilityEvery step of an agent run as a trace →

LLM observabilityToken usage, model latency and finish reasons →

Application performanceTraces, service graph and the critical path →

Questions

What security reviewers ask about this.

Something not here? Book thirty minutes with an engineer who works on the platform. Book a call →

Is it safe to let a coding agent near this data?: A connection acts as the person who approved it and never exceeds that person's role. They tick which capabilities it may use, nothing it can do deletes anything, and every change is attributed in the audit trail.
How does it authenticate?: Through the browser, as a person, so there is no long-lived token pasted into a config file for someone to find later.
Can we see what it did?: Yes. Every action is attributed to the connection and the person behind it, in the same audit trail as the rest of the tenant.
What happens when someone leaves?: The connection inherits their role, so removing their access removes the agent's. There is no separate service identity to remember to clean up.

Start on the free tier.

20K active series, 50 GB of logs and 50 GB of traces a month, 90-day retention, and the whole of Insights.

Start free→Book a demo