Claude Code audit logs: what exists on Team vs Enterprise, and the gaps

the short answer

It depends on plan and on what you need to prove. Claude audit log exports are Enterprise-only and cover organization events. The Compliance API, also Enterprise, returns Claude Code session transcripts for terminal, desktop and IDE sessions, but not Bedrock, Vertex, API-key or cloud sessions. On any plan, OpenTelemetry exports tool decisions and, if enabled, commands. A hook-level policy layer adds per-call allow and deny decisions on every machine.

Audit log export: Enterprise only; 180-day lookback; unavailable with customer-managed keys
Compliance API: Enterprise; transcripts for local Claude Code sessions
Excluded from Compliance API: API-key, Bedrock, Vertex, Foundry, cloud sessions, ZDR
OpenTelemetry: Any plan; tool_decision, tool_result; commands with OTEL_LOG_TOOL_DETAILS=1
Policy decisions: Hook-level log per machine

Four Sources, Compared

Source	Plan	What it records	Gaps
Audit log export (claude.ai)	Enterprise	Organization events, exportable by Owners	Chat and project content excluded; Claude Code activity not described; export unavailable with customer-managed encryption keys
Compliance API	Enterprise (Activity Feed also via Console Admin API)	Session transcripts for terminal, desktop and IDE Claude Code	Not Bedrock, Vertex, Foundry or API-key auth; not cloud sessions; shows what Claude was asked, not what happened on the device
OpenTelemetry	Any	Metrics; events such as `tool_decision`, `tool_result`, `user_prompt` (content opt-in)	You run the collector; MCP tool names appear as `mcp_tool` unless `OTEL_LOG_TOOL_DETAILS=1`
Hook-level policy log	Any	Every gated call with the allow, instruct or deny decision and reason, per machine	Requires a client on each machine

On the Team Plan

Set the exporter selectors (OTEL_LOGS_EXPORTER, OTEL_METRICS_EXPORTER) in managed settings too: when managed settings set them, project and local settings cannot turn them off.

{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel-collector.example.com",
    "OTEL_LOG_TOOL_DETAILS": "1"
  }
}

What Failproof Adds

Sessions and policy decisions. Every session from every connected machine, with each allow, instruct and deny, in Observe → Sessions and Observe → policy.
Queries. SQL over sessions, events and decisions under Analyze → Queries, saved and shared.
Cloud audits. Recurring reviews of a session population for a stated failure, producing findings and issues.
Local audit. failproofai audit scans the Claude Code history already on a laptop, offline, with no account.
Alerts. Rules that notify by email, Slack or webhook when a condition returns.
OpenTelemetry ingest. failproofai otel enable claude sends Claude Code’s own telemetry to FailproofAI Cloud as sessions.

Which Source Answers Which Audit Question

Question	Best source
What did this agent run on this laptop yesterday?	OTel with tool details, or the hook decision log
Was a destructive command blocked, and by which rule?	Hook decision log
What did the developer ask the agent?	Compliance API transcripts, or OTel with `OTEL_LOG_USER_PROMPTS=1`
Who changed organization settings?	Audit log export
Which sessions touched production credentials?	Session traces correlated with cloud audit logs

FAQ

Does OpenTelemetry include bash commands?

Only with OTEL_LOG_TOOL_DETAILS=1, which adds the command to tool events. Without it you get tool names (MCP tools only as mcp_tool) and decisions.

Can developers turn telemetry off?

Not if managed settings set the exporter selectors. If you leave a selector out, a repository or user can set it to none, so set all of them in managed settings.

Does Failproof replace these?

It complements them: Failproof records the policy decision for each call in one place across every supported agent. Vendor telemetry covers only its own agent, and only some of it records decisions (Claude Code and Codex OpenTelemetry emit tool_decision events).

Sources

Checked against the sources below on October 21, 2026. Harness settings, hook capabilities and cloud features change between versions.