Coding-Agent Audit Log Retention: Storage Cost Is the Small Part

Audit-log retention for coding agents is often framed as cents per gigabyte, but raw storage is rarely the dominant cost. Ingestion, indexing, query performance, redaction, privacy review, cross-system joins, and incident retrieval determine whether retained evidence is useful or merely an expanding liability.

Start with purposes, not a universal duration. Operational debugging may need detailed events for days. Cost attribution may need structured summaries for months. Security investigations, legal holds, or regulated changes may require longer evidence. Assign each event class an owner, lawful purpose, access policy, and deletion rule.

Classify the Event Stream

Separate prompts, responses, token counts, model and provider, tool arguments, tool results, permission decisions, shell commands, file changes, network destinations, commits, approvals, and task outcomes. Most cost dashboards need metadata rather than full content. Keep content only where its diagnostic value exceeds privacy and security exposure.

Use one task identifier across model gateway, agent runtime, tools, sandboxes, source control, CI, and review. Without the join key, teams retain large volumes but cannot reconstruct a trajectory. The cheapest byte is not useful if analysts spend hours manually correlating timestamps.

Calculate Monthly Volume

Estimate tasks per day, events per task, average structured event size, payload attachment size, replication, and index expansion. Ten thousand daily tasks with 150 events averaging two kilobytes create about 300 gigabytes of raw structured data per day before indexes and replicas. A small percentage of screenshots, patches, or command output can exceed that base.

Model hot, warm, and archive tiers separately. Hot searchable data may cost many times more than compressed object storage. Include ingestion, queries, rehydration, egress, backups, encryption keys, and deletion verification. Apply the provider's actual billing units and minimums rather than a generic per-gigabyte estimate.

Minimize Before Retaining

Drop redundant heartbeats, repeated context, and deterministic tool output at collection time when policy allows. Hash or reference immutable artifacts instead of copying them into every event. Summarize large logs with a reproducible parser and keep a short-lived raw object for investigation. Sampling is appropriate for routine success telemetry, not for security-relevant denials or production mutations.

Redact secrets before storage, not only at query time. Test token, key, cookie, personal data, and customer-content patterns with synthetic fixtures. Record redaction version and failure metrics. A log archive that collects credentials becomes another high-value system requiring expensive controls.

Define Retrieval Service Levels

• Recent failed tasks should be searchable within minutes by task and repository.
• Production side effects should preserve complete authorization evidence.
• Archived data should have a documented restore time and request owner.
• Deletion should be verifiable across indexes, replicas, and derived datasets.

Run retrieval drills. Give an analyst a task ID, incident symptom, and time limit, then measure time to reconstruct input, tool calls, permission decisions, changes, and result. If retained evidence cannot answer basic questions, shorten or redesign the pipeline before buying more years of storage.

Price Human and Compliance Work

Include access reviews, schema maintenance, retention exceptions, legal holds, data-subject requests, incident queries, and deletion audits. Track analyst minutes per investigation and support ticket. A complex archive can cost far more to govern than to store.

Use cost per reconstructable task and cost per resolved incident, not only cost per terabyte. Report coverage gaps, redaction failures, retrieval latency, and orphaned schemas. Retention has value when it shortens decisions and proves accountability.

Review the Policy

Recalculate after model verbosity, tool catalogs, screenshot use, task volume, regulation, or provider pricing changes. Version retention by event class and stop new writers from silently creating an unclassified stream. Expired data should disappear automatically unless a documented hold applies.

A tiered policy keeps detailed evidence where investigation probability is highest and compact summaries for long-term trends. It also limits the blast radius of sensitive content. Longer is not automatically safer.

Run a Retention Simulation

Before committing to a year of data, replay 30 days of representative events through proposed hot, warm, and archive tiers. Measure compression, index expansion, query volume, rehydration, redaction failure, and analyst reconstruction time. Extrapolate with traffic growth and show ranges for screenshot or tool-output expansion.

Then simulate deletion. Expire a test cohort and verify removal from search indexes, primary objects, replicas, caches, and derived tables while preserving approved aggregate metrics. Record the elapsed time and operator work. A retention architecture is incomplete if it can ingest evidence quickly but cannot find or delete the same evidence predictably.

Bottom Line

Budget the complete audit-data service: collection, minimization, indexing, security, retrieval, governance, and deletion. Choose duration per purpose, preserve task joins, and test reconstruction. Storage is cheap only when the surrounding evidence system is designed to stay useful and safe.