Acceptance criteria
Record the prompts, responses, uploaded files and tool calls that make up each conversation, with content capture set per policy: full, partial, metadata-only or none, in line with privacy and retention rules.
Why it matters
The conversation, not the single prompt, is the unit an investigator or auditor needs to see.
How to verify
Show one pilot conversation's record at full, partial and metadata-only capture settings.
OWASP adoption context
Logging-depth choices apply across adoption tiers, balancing needed evidence against data minimization and any applicable retention rule.
Framework mappings
Selectable prompt/response capture provides AI/security logging evidence while letting privacy and retention policy constrain content depth. The buyer must test that each chosen mode preserves needed event metadata; capture configuration alone establishes neither log integrity nor an adequate monitoring and retention process. SOC 2: P3.1/P4.2 require the Privacy category and relevant information in scope.
Choosing and documenting content depth can supply evidence for evaluating transparency and accountability alongside privacy trade-offs. A configuration option alone does not establish the evaluation or its adequacy.
Configurable prompt and response capture supports logging design and privacy minimization. Preserve needed event metadata, usable attribution and appropriate retention, protection and analysis even when content capture is disabled. Capture-depth options alone establish neither log integrity, record protection nor lawful monitoring.