Know the collection path
The local CLI reads supported session data and computes analytics before sync. Provider, platform, OpenTelemetry, and observability connections can follow a different path. For the local CLI path, computed fields can include token counts, tool names and counts, retry signals, efficiency, and context-health metrics. Raw prompts, responses, and tool input/output are not part of that sync path.Protect identity mapping
A wrong mapping can assign sessions, spend, or outcomes to the wrong person.- Limit who can change mappings.
- Review new and changed provider identities.
- Leave uncertain identities unresolved.
- Give members a way to report attribution errors.
- Record mapping changes when auditability is required.
Define visibility and purpose
Decide:- Who can access workspace, team, project, and member views
- Whether reports may be exported or redistributed
- Which metrics are appropriate for coaching
- Which uses are prohibited
- How members can challenge or correct the data
Preview local data
Security basics
- Store provider keys in approved secret storage.
- Use the narrowest available scope.
- Rotate credentials under change control.
- Keep credentials, prompts, and source code out of screenshots and support messages.
- Test member and administrator offboarding.