> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Anthale Metadata and Logs for Runtime Operations

> Attach metadata and use Anthale logs to trace runtime enforcement decisions, investigate policy hits, and tune guardrail policies in production.

Anthale records runtime enforcement decisions so teams can investigate incidents and tune policies. Metadata is what turns those events into operational signals.

## What gets logged

* Returned action: `allow`, `detect`, `redact`, or `block`.
* Triggered guardrails.
* Confidence or evidence when available.
* Metadata for correlation and investigation.
* Latency and request context.

## Common tasks

<Columns cols={2}>
  <Card title="Choose Metadata Fields" icon="tags" href="/docs/learn/metadata-and-logs/what-metadata-to-send-with-enforcement-requests">
    Send stable identifiers that let operators trace Anthale behavior by boundary, feature, tenant, session, source, and
    tool.
  </Card>

  <Card title="Investigate a Policy Hit" icon="search" href="/docs/learn/metadata-and-logs/investigate-a-policy-hit">
    Work back from `detect`, `redact`, and `block` events to the feature, source, and workflow that produced them.
  </Card>
</Columns>

## Retention considerations

Retention should match your operational and compliance needs. Lower-risk workloads usually need shorter windows, while regulated or high-assurance workloads often need longer audit trails.

## Runtime-only tradeoff

Some teams choose not to retain enforcement logs for highly sensitive applications and use Anthale only as a runtime decision layer. That can reduce the amount of stored operational data, but it also means you lose much of the observability that makes a control system explainable in production. In practice, that means weaker incident investigation, less policy tuning feedback, reduced auditability, and less evidence for why a request was allowed, detected, redacted, or blocked.

<Warning>
  Runtime-only enforcement can be the right choice for high-sensitivity workloads, but you should treat it as a
  tradeoff, not a free win. Less logging usually means less observability, less explainability, and fewer operational
  signals when something goes wrong.
</Warning>

Anthale-side export and retention controls are product-surface details. Use current platform behavior and legal documents as the source of truth for contractual commitments.

## Operational value

Good metadata helps teams trace incidents, compare policy behavior across features and services, and route Anthale results into security and observability workflows.

## Metadata hygiene

Prefer:

* Stable internal identifiers.
* Pseudonymous values where possible.
* Operational context over raw personal data.

Avoid:

* Unnecessary PII in metadata fields.
* Free-form sensitive content.
* Values your incident tooling does not actually use.

## Next steps

From here, read [What Metadata to Send with Anthale Enforcement Requests](/docs/learn/metadata-and-logs/what-metadata-to-send-with-enforcement-requests), [Investigate Anthale Policy Hits in Production](/docs/learn/metadata-and-logs/investigate-a-policy-hit), [Policies](/docs/learn/policies), or [Actions and Evaluation Flow](/docs/learn/policies/actions-and-evaluation-flow).