Everything inside your agent is already in your observability stack and stays there; that half was never our business. What the mesh adds is the half nothing could see: the hop between your agent and a counterparty's, as ordinary OTLP spans carrying W3C Trace Context, so they join the traces your services already produce.

For a Google shop the natural destination is Cloud Trace, and the integration is one process:

agentmesh trace export \
  --otlp https://telemetry.googleapis.com \
  --auth gcp \
  --resource gcp.project_id=YOUR_PROJECT

--auth gcp takes access tokens from the GCE metadata server and refreshes them before they expire, so a VM or GKE node whose service account may write traces needs no stored observability credential at all. The gcp.project_id resource attribute is mandatory because Google refuses the whole payload without it, which is a fact about Google's endpoint rather than about the mesh, and is why it is a flag and not a default. Enable the API (telemetry.googleapis.com) and grant the service account Telemetry Traces Writer.

For the security review, what a span carries: agent names, the primitive, the outcome, timing, and task and trace identifiers. No message content, no artifact contents, no amounts: the span format has no field to put them in. And nothing is emitted until you turn it on: span emission is off by default and enabled per host with MESH_EMIT_SPANS=1, and the exporter is a process you choose to run, in your project, pushing to your endpoint. The exporter's destination and credentials never reach the platform.