Start with the decision context
Bind each request to a tenant, workload, environment, client mode, user or principal, route, provider account, data class, and applicable control version. That is usually more actionable than a large content archive when investigating ownership, spend, or control coverage.
Retain the minimum useful evidence
AI Gateway HQ's hosted baseline retains reason-coded operational metadata, bounded tool names and types, MCP hosts, cost, token, timing, provider-attempt, and outcome evidence. Prompt/response bodies, tool schemas, arguments, and tool results are not written to the durable evidence ledger by default.
Be explicit about the remaining boundaries
An application, provider, SIEM export destination, or customer-configured cache may have different retention. Governance requires documenting those paths, not assuming a gateway setting controls every downstream system.