Quick answer
Cloudflare Agents session replay can expose the exact context that explains a turn: system instructions, user messages, model thinking, tool calls, tool arguments and results, and the final response. That makes it useful for debugging and sensitive by design.
Decide what may be recorded before enabling payload capture. Replay is recorded evidence, not a safe copy of every source system and not a re-execution.
Capture decision table
| Data surface | Debugging value | Primary review |
|---|---|---|
| System instructions | Explains policy and routing behavior | Secrets, internal policy, prompt exposure |
| User messages | Shows the available task context | Personal, confidential, regulated data |
| Model thinking where captured | Helps inspect decision progression | Sensitive inference and access scope |
| Tool arguments | Reveals malformed or over-broad calls | Credentials, identifiers, destructive scope |
| Tool results | Shows what the agent actually received | Source permissions, personal data, retention |
| Final response | Supports outcome review | Accuracy, disclosure, downstream sharing |
Cloudflare says storeMessages and storeTools control payload recording for the documented Think, Flue, and AI SDK integrations. Turn capture off when messages or tool data may contain secrets, personal information, or other sensitive content.
Privacy rollout checklist
- Inventory message and tool data classes before tracing.
- Remove credentials and minimize identifiers at the source.
- Set payload capture separately from span metadata.
- Test who can access the dashboard and exported traces.
- Confirm plan retention and any OTLP destination retention.
- Define incident preservation and deletion procedures.
- Recheck capture after adding a tool, subagent, or external destination.
Use the pricing and retention guide for storage windows and the tool-call debugging guide for a bounded review flow.
What replay cannot prove
Replay can show that a tool returned a value; it cannot prove the value was current, authorized, complete, or correct. It can show that an approval event occurred; it does not by itself prove the approver saw the final scope. Keep source-system audit logs and outcome validation separate.
Frequently asked questions
What can replay contain?
Depending on harness and configuration, recorded instructions, messages, model thinking, tool calls, arguments, results, and the response.
Can payload capture be disabled?
Cloudflare documents storeMessages and storeTools controls for its supported integrations.
Is replay a re-execution?
No. It presents captured data from the original turn.
Official sources
Source check: August 6, 2026. Verify current capture fields, access controls, retention, and export behavior for the selected harness.