Cowork can stream its activity to your own OpenTelemetry collector. For an Australian firm that has to answer to a risk committee, that is the feature which turns Cowork from a productivity tool into something an auditor can sign off. It also carries a default that deserves attention before anyone flicks the switch.
User prompt content is included in events by default. So are user email addresses. There is no automatic redaction at the source.
What actually gets exported
The stream is detailed, and the detail is the point:
The full text of prompts users submit to Cowork.
Tool and MCP invocations, including server name, tool name, parameters, success or failure, and execution time.
File paths Claude reads, modifies or otherwise touches during a session.
Which skills and plugins Claude invoked.
Human approval decisions, recorded as approved, rejected or auto initiated.
API requests and errors, with model, token counts, estimated cost, duration and error detail.
A shared prompt.id attribute ties every event from a single user input together, so a whole session can be reconstructed end to end. For anyone who has tried to answer the question of what an AI tool actually did last Tuesday, that is the answer, and it is a considerably better answer than most software gives you.
Setup, and who it is for
OpenTelemetry export is available on Team and Enterprise plans only. It covers cloud sessions on desktop, web and mobile, and local desktop sessions, with minimum desktop app versions for each.
Configuration lives in Organization settings, then Cowork. Enter your OTLP endpoint, choose HTTP JSON or HTTP protobuf, add authentication headers, and save. Events start flowing immediately. Authentication headers are encrypted at rest on Anthropic servers, and nothing exports at all until an admin sets an endpoint, so the default state is silence rather than leakage.
Standard collectors work, so the usual destinations apply: Splunk, Cribl, Elasticsearch, Loki, ClickHouse, Honeycomb and Datadog among them. If your security team already runs one, this is a configuration task rather than a project.
The privacy work is yours, at the collector
This is where Australian obligations land. If your business handles personal information under the Privacy Act, or sits under APRA CPS 234, the fact that prompt text leaves Anthropic's side unredacted means your collector is the control point rather than the vendor.
Filter or hash prompt content at the collector if your policy prohibits storing it.
Assume tool parameters carry sensitive values, because file paths and command arguments are exported as written.
Set retention deliberately. Full session reconstruction is useful at ninety days and a liability at seven years.
Restrict who can query the index. Prompts are staff writing, and staff will write things they would never put in a ticket.
Getting this wrong is not a technical failure, it is a notifiable one. An external privacy review after an incident starts around $15,000 and the reputational cost runs well past that, particularly for a firm whose clients chose it for discretion.
What it buys you, once configured
The reason to do this work is that it changes the conversation with the people who can stop your rollout. Instead of assurances about what an AI tool probably does, you have events.
Which connectors are actually being used, as against which ones were requested during procurement.
Which staff are approving actions and which are auto initiating them, which tells you where your training gap is.
What the thing costs per team, from real token counts rather than a vendor estimate.
That third point tends to surprise people. Most organisations discover their heaviest user is not who they assumed, and that a handful of poorly shaped recurring tasks account for a large share of consumption.
The objection you will hear internally
Someone will ask why the telemetry needs prompt text at all, and it is a fair question. The answer is that a tool call without the instruction behind it is close to useless in an investigation. Knowing a file was read tells you nothing about whether it should have been. Knowing what was asked, and by whom, is the difference between a log and an audit trail.
The workable position for most Australian firms sits in the middle: keep prompt text, keep it for a bounded window, and lock the index down to the two or three people who would run an investigation. That satisfies the risk function without creating a searchable archive of everything your staff typed.
The order to do it in
Turn telemetry on before you widen the rollout, not after. A month of clean event data answers the questions a risk committee will ask, and answers them with evidence rather than promises. Then write the collector side filtering rules before the first real user prompt lands in the index, because retrofitting redaction across an existing index is a far worse afternoon.
If you are preparing a Cowork rollout that has to survive an internal security review, the telemetry configuration is the piece worth getting right first. We help Australian teams set exactly this up. Start at /contact.
