The four altitudes

Open this page when you are deciding where a fact goes. The four altitudes are not four screens — they are one component family reading one data source, and almost every hard question in agent transparency reduces to which altitude a given fact belongs at, and who is reading that altitude when they meet it.

The test for each altitude is the same: name the reader and what they do next. A fact that does not change what its reader does next is at the wrong altitude, and pushing it down is almost always the right move — Google’s People + AI Guidebook puts it as explaining “just the aspects that impact user trust and decision-making,” and names progressive disclosure as the way to keep the rest reachable rather than absent.

Altitude 01

Collapsed summary

Did this work, and can I move on?

Who reads it: Everyone. This is the altitude most likely to be the only one a reader sees, including the person who accepts the output and never opens anything else.

What belongs here

What the run produced, in the run’s own domain terms — not in step terms.
Whether it fully succeeded. A run that recovered from a failure is not the same as a run that had none, and the difference belongs here, not three clicks down.
Wall-clock duration, if a human waited for it.
One affordance to go deeper, always visible, never a hover.

What does not

Step counts, span counts, token counts — quantities that mean nothing without the tree they came from.
Model names, provider names, framework internals.
Any number the reader cannot act on at this altitude.

Failure mode: Over-summarising into dishonesty. A run that errored at step seven, retried, and produced an answer says “done” here, and the failure is now invisible rather than merely buried — it is the only failure mode on this page that a reviewer cannot discover by clicking.

Altitude 02

Step list

What did it do, in order, and where did it struggle?

Who reads it: A reviewer deciding whether to trust this particular run. Domain expert, not engineer. They are scanning, not reading.

What belongs here

One row per logical operation — not one row per emitted span. A retried call is one row that says it took two attempts.
Status per row, with failure and recovered-from-failure visually distinct from success.
Duration per row, so the slow step is findable without arithmetic.
Enough of the tool’s arguments to identify what it acted on — the record id, the URL, the query — and nothing more.

What does not

Framework-internal spans. Nobody reviewing an extraction run needs to see a parser step.
Full arguments or full results. Those are the next altitude down, for a reason.
The model’s stated reason for choosing a step, presented as though it were a record of the decision.

Failure mode: Rendering emitted spans one-to-one instead of logical operations. It is the path of least resistance and it produces the two classic lies: a retried call that reads as the agent duplicating work, and parallel calls stacked vertically that read as a causal sequence.

Altitude 03

Full trace

Exactly what happened here, and why did this step behave that way?

Who reads it: Whoever is debugging one specific run — usually an engineer, occasionally a domain expert who has decided something is wrong and wants proof.

What belongs here

The real tree: parent and child, siblings that overlap in time shown as overlapping.
Every attempt, including the failed ones, with error type and message.
Complete tool arguments and complete results, subject to the redaction model.
Per-step token counts and latency, with cost only where its provenance can be stated.

What does not

Serve as the default view. Opening here is the most common way a good trace panel becomes an unused one.
Pretend to be an audit log. It is a rendering of telemetry, which is sampled, lossy and best-effort by design.

Failure mode: Making this the entry point because it is the most impressive to demo. Every fact is true and the reviewer cannot find the one that matters, so they stop opening the panel at all — which costs more than never building it.

Altitude 04

Raw payload

What did the runtime literally emit?

Who reads it: The engineer reproducing a bug, and the person who has just found a discrepancy between altitudes 1–3 and needs to know which layer introduced it.

What belongs here

The unrendered records, in the runtime’s own field names — not your schema’s.
The runtime and version that produced them.
A copy affordance, because the actual use of this altitude is pasting it somewhere else.

What does not

Get shown to end users by default, or reachable without deliberate intent.
Carry unredacted arguments. Redaction happens at the data layer; if this altitude can show a secret, the redaction was a view-layer truncation and therefore was not redaction.

Failure mode: Treating it as free because it is “just the data.” It is the altitude with the entire privacy surface of the system on it, and the one most likely to be built last and reviewed least.

Four altitudes is more levels than the usability research recommends

This is worth stating plainly rather than hiding. Jakob Nielsen’s progressive disclosure article (Nielsen Norman Group, December 2006) reports that designs going beyond two disclosure levels typically have low usability, because people lose track of where they are between levels. Four exceeds that, and the honest resolution is not to argue with the finding.

It is to notice that these four are not four levels of one control. Altitudes 01 and 02 are the product surface, and the step from one to the other is a single disclosure a reviewer performs in place. Altitudes 03 and 04 are an inspector — a separate destination, entered deliberately, by a different reader, usually with a different goal. Building all four as nested expanders in one panel is exactly the design Nielsen’s finding warns about. Building two disclosures on the surface and a two-level inspector behind an explicit door is not.

The rule underneath all four

Every altitude renders from the same schema. If a fact appears at altitude 02 that cannot be traced to something at altitude 04, the component invented it, and the place to find out is here rather than from a reviewer who noticed the discrepancy first. That single constraint — one data source, four projections, no fact without a source — is what makes the family defensible in a room, and it is why the course spends its whole first module on the schema before drawing anything.

Every claim on these pages links to its source. If a source looks wrong or out of date, check the resource list and tell your teaching agent — the course is meant to be corrected.