[FEATURE] Org-level content capture policy for Cowork OpenTelemetry export (admin console)
Problem
On first-party Team/Enterprise orgs, the Cowork OTLP export sends user prompts, model responses, and tool arguments by default. The only control is otlpContentCapture, a device-level MDM key. That doesn't work as an org policy:
- Cowork sessions that run in the cloud (started from the browser or mobile) don't run on a managed device, so the device key never applies to them.
- Any device without the MDM profile (personal machines, Windows, newly enrolled Macs) sends full content.
- The OTLP endpoint is set org-wide in the admin console. So turning on monitoring, or even testing it, immediately exports full content from every user whose device lacks the key.
The only full workaround is to run your own internet-facing collector that strips content before it gets to the observability vendor. That's a new public service to secure, monitor and keep in compliance scope, just to get usage metadata.
Request
Add a content capture policy next to the OTLP endpoint in Admin settings → Cowork, using the same categories as otlpContentCapture (userPrompts, assistantResponses, toolDetails, toolContent, rawApiBodies). Enforce it server-side for cloud sessions, and apply it on every device as the minimum (a device key could add content but never go below the org setting). Ideally default it to metadata only, matching Claude Code's OTEL_LOG_* defaults. An option to leave out workspace.host_paths would also help.
Context
Claude Code CLI telemetry already defaults to metadata only (prompt arrives as <REDACTED>), and we've run it org-wide through server-managed settings for months. We turned Cowork export off in May because it sent full conversations, and we can't turn it back on without hosting a filtering collector.
Related: #89594 (docs contradiction), #88490 (cloud session identity attributes)