A useful log tells you what happened.
Make agent execution understandable to the next person investigating it.
A tool call is easier to assess when its purpose, tool identity, and outcome are visible together. Logs should support an investigation without becoming a second store of private customer data.
Capture the shape of the work
Record which profile and tool were involved, when the request happened, and whether it completed. Keep sensitive input fields out of general logs.
Follow the failure
Separate authentication failures, unavailable services, and invalid requests. Each calls for a different next step.
Use the findings
Recurring failures are a reason to improve a tool contract or its documentation. They are not automatically a reason to give the agent broader permissions.