diff --git a/README.md b/README.md
index 6e4ba92e..ee0cb311 100644
--- a/README.md
+++ b/README.md
@@ -274,7 +274,7 @@ kubectl logs -l app.kubernetes.io/name=weather-agent
 See the [config/samples](./kagenti-operator/config/samples) directory for AgentRuntime examples:
 
 - [`agent_v1alpha1_agentruntime_basic.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml) — Minimal AgentRuntime with type + targetRef
-- [`agent_v1alpha1_agentruntime_full.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain and OTEL trace overrides
+- [`agent_v1alpha1_agentruntime_full.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml) — With SPIFFE trust domain override and OCI skill images
 - [`agent_v1alpha1_agentruntime_tool.yaml`](./kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml) — Tool-type workload (MCP server)
 
 ## Contributing
diff --git a/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml b/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml
index 29254e16..2ff3803f 100644
--- a/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml
+++ b/charts/kagenti-operator/crds/agent.kagenti.dev_agentruntimes.yaml
@@ -43,8 +43,8 @@ spec:
       openAPIV3Schema:
         description: |-
           AgentRuntime attaches runtime configuration to a backing workload classified as an
-          agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-          tracing. The controller reports pod configuration coverage and phase in status.
+          agent or tool, providing per-workload overrides for SPIFFE identity.
+          The controller reports pod configuration coverage and phase in status.
         properties:
           apiVersion:
             description: |-
@@ -228,30 +228,6 @@ spec:
                 - kind
                 - name
                 type: object
-              trace:
-                description: Trace specifies optional per-workload observability overrides
-                properties:
-                  endpoint:
-                    description: Endpoint is the OTEL collector endpoint override
-                    type: string
-                  protocol:
-                    description: Protocol is the OTEL export protocol (grpc or http)
-                    enum:
-                    - grpc
-                    - http
-                    type: string
-                  sampling:
-                    description: Sampling specifies trace sampling configuration
-                    properties:
-                      rate:
-                        description: Rate is the sampling rate (0.0-1.0)
-                        maximum: 1
-                        minimum: 0
-                        type: number
-                    required:
-                    - rate
-                    type: object
-                type: object
               type:
                 description: Type classifies the workload as an agent or tool
                 enum:
diff --git a/kagenti-operator/GETTING_STARTED.md b/kagenti-operator/GETTING_STARTED.md
index c9b78c0a..96ce99c6 100644
--- a/kagenti-operator/GETTING_STARTED.md
+++ b/kagenti-operator/GETTING_STARTED.md
@@ -156,16 +156,14 @@ kubectl get pods -n team1 -l kagenti.io/type=agent -o jsonpath='{.items[0].spec.
 
 ### Updating Configuration
 
-When you update the AgentRuntime CR (e.g., changing the trust domain or trace endpoint), the controller recomputes the config hash and triggers a rolling update automatically:
+When you update the AgentRuntime CR (e.g., changing the trust domain), the controller recomputes the config hash and triggers a rolling update automatically:
 
 ```bash
 kubectl patch agentruntime weather-agent-runtime -n team1 --type merge -p '
 spec:
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.5
+  identity:
+    spiffe:
+      trustDomain: custom.example.com
 '
 ```
 
diff --git a/kagenti-operator/api/v1alpha1/agentruntime_types.go b/kagenti-operator/api/v1alpha1/agentruntime_types.go
index 8d8ba9bc..bbc0f1e9 100644
--- a/kagenti-operator/api/v1alpha1/agentruntime_types.go
+++ b/kagenti-operator/api/v1alpha1/agentruntime_types.go
@@ -37,14 +37,6 @@ const (
 	RuntimePhaseError   RuntimePhase = "Error"
 )
 
-// +kubebuilder:validation:Enum=grpc;http
-type TraceProtocol string
-
-const (
-	TraceProtocolGRPC TraceProtocol = "grpc"
-	TraceProtocolHTTP TraceProtocol = "http"
-)
-
 // AgentRuntimeSpec defines the desired state of AgentRuntime.
 type AgentRuntimeSpec struct {
 	// Type classifies the workload as an agent or tool
@@ -57,10 +49,6 @@ type AgentRuntimeSpec struct {
 	// +optional
 	Identity *IdentitySpec `json:"identity,omitempty"`
 
-	// Trace specifies optional per-workload observability overrides
-	// +optional
-	Trace *TraceSpec `json:"trace,omitempty"`
-
 	// AuthBridgeMode selects the deployment shape for this workload's
 	// authbridge sidecar. When unset, the namespace-level
 	// authbridge-runtime-config ConfigMap's mode is used; if that is
@@ -159,29 +147,6 @@ type SPIFFEIdentity struct {
 	TrustDomain string `json:"trustDomain,omitempty"`
 }
 
-// TraceSpec configures observability for an AgentRuntime.
-type TraceSpec struct {
-	// Endpoint is the OTEL collector endpoint override
-	// +optional
-	Endpoint string `json:"endpoint,omitempty"`
-
-	// Protocol is the OTEL export protocol (grpc or http)
-	// +optional
-	Protocol TraceProtocol `json:"protocol,omitempty"`
-
-	// Sampling specifies trace sampling configuration
-	// +optional
-	Sampling *SamplingSpec `json:"sampling,omitempty"`
-}
-
-// SamplingSpec configures trace sampling for an AgentRuntime.
-type SamplingSpec struct {
-	// Rate is the sampling rate (0.0-1.0)
-	// +kubebuilder:validation:Minimum=0
-	// +kubebuilder:validation:Maximum=1
-	Rate float64 `json:"rate"`
-}
-
 // CardStatus holds the fetched A2A agent card data along with fetch metadata
 // and optional verification results. Populated by the card discovery phase when
 // --enable-card-discovery is set.
@@ -281,8 +246,8 @@ type AgentRuntimeStatus struct {
 // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
 
 // AgentRuntime attaches runtime configuration to a backing workload classified as an
-// agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-// tracing. The controller reports pod configuration coverage and phase in status.
+// agent or tool, providing per-workload overrides for SPIFFE identity.
+// The controller reports pod configuration coverage and phase in status.
 type AgentRuntime struct {
 	metav1.TypeMeta   `json:",inline"`
 	metav1.ObjectMeta `json:"metadata,omitempty"`
diff --git a/kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go b/kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go
index 7a294f93..5f1bc422 100644
--- a/kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go
+++ b/kagenti-operator/api/v1alpha1/zz_generated.deepcopy.go
@@ -377,11 +377,6 @@ func (in *AgentRuntimeSpec) DeepCopyInto(out *AgentRuntimeSpec) {
 		*out = new(IdentitySpec)
 		(*in).DeepCopyInto(*out)
 	}
-	if in.Trace != nil {
-		in, out := &in.Trace, &out.Trace
-		*out = new(TraceSpec)
-		(*in).DeepCopyInto(*out)
-	}
 	if in.Skills != nil {
 		in, out := &in.Skills, &out.Skills
 		*out = make([]SkillImageRef, len(*in))
@@ -567,21 +562,6 @@ func (in *SPIFFEIdentity) DeepCopy() *SPIFFEIdentity {
 	return out
 }
 
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *SamplingSpec) DeepCopyInto(out *SamplingSpec) {
-	*out = *in
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SamplingSpec.
-func (in *SamplingSpec) DeepCopy() *SamplingSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(SamplingSpec)
-	in.DeepCopyInto(out)
-	return out
-}
-
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *SignatureHeader) DeepCopyInto(out *SignatureHeader) {
 	*out = *in
@@ -646,23 +626,3 @@ func (in *TargetRef) DeepCopy() *TargetRef {
 	in.DeepCopyInto(out)
 	return out
 }
-
-// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
-func (in *TraceSpec) DeepCopyInto(out *TraceSpec) {
-	*out = *in
-	if in.Sampling != nil {
-		in, out := &in.Sampling, &out.Sampling
-		*out = new(SamplingSpec)
-		**out = **in
-	}
-}
-
-// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TraceSpec.
-func (in *TraceSpec) DeepCopy() *TraceSpec {
-	if in == nil {
-		return nil
-	}
-	out := new(TraceSpec)
-	in.DeepCopyInto(out)
-	return out
-}
diff --git a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml
index 29254e16..2ff3803f 100644
--- a/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml
+++ b/kagenti-operator/config/crd/bases/agent.kagenti.dev_agentruntimes.yaml
@@ -43,8 +43,8 @@ spec:
       openAPIV3Schema:
         description: |-
           AgentRuntime attaches runtime configuration to a backing workload classified as an
-          agent or tool, providing per-workload overrides for SPIFFE identity and OpenTelemetry
-          tracing. The controller reports pod configuration coverage and phase in status.
+          agent or tool, providing per-workload overrides for SPIFFE identity.
+          The controller reports pod configuration coverage and phase in status.
         properties:
           apiVersion:
             description: |-
@@ -228,30 +228,6 @@ spec:
                 - kind
                 - name
                 type: object
-              trace:
-                description: Trace specifies optional per-workload observability overrides
-                properties:
-                  endpoint:
-                    description: Endpoint is the OTEL collector endpoint override
-                    type: string
-                  protocol:
-                    description: Protocol is the OTEL export protocol (grpc or http)
-                    enum:
-                    - grpc
-                    - http
-                    type: string
-                  sampling:
-                    description: Sampling specifies trace sampling configuration
-                    properties:
-                      rate:
-                        description: Rate is the sampling rate (0.0-1.0)
-                        maximum: 1
-                        minimum: 0
-                        type: number
-                    required:
-                    - rate
-                    type: object
-                type: object
               type:
                 description: Type classifies the workload as an agent or tool
                 enum:
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
index b5edb669..f8116b24 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
+++ b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_basic.yaml
@@ -1,6 +1,6 @@
 # Basic AgentRuntime: enroll a Deployment as an agent with default configuration.
 # The controller applies kagenti.io/type label and triggers sidecar injection.
-# Identity and trace settings come from cluster and namespace defaults.
+# Identity settings come from cluster and namespace defaults.
 # Note: The target Deployment should have a protocol.kagenti.io/a2a label
 # for automatic AgentCard creation and agent discovery.
 apiVersion: agent.kagenti.dev/v1alpha1
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
index 23ae2a80..b003652e 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
+++ b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_full.yaml
@@ -1,6 +1,6 @@
 # Full AgentRuntime: enroll a Deployment as an agent with per-workload overrides.
-# Overrides the SPIFFE trust domain, configures OTEL trace collection, and
-# mounts OCI skill images (requires skillImageVolumes feature gate + K8s 1.31+).
+# Overrides the SPIFFE trust domain, and mounts OCI skill images
+# (requires skillImageVolumes feature gate + K8s 1.31+).
 apiVersion: agent.kagenti.dev/v1alpha1
 kind: AgentRuntime
 metadata:
@@ -17,11 +17,6 @@ spec:
   identity:
     spiffe:
       trustDomain: custom.example.com
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.1
   skills:
     - name: weather-forecast
       image: ghcr.io/redhat-et/skillimage/weather-forecast:v1.0.0
diff --git a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
index e0abae4f..b2a7d77b 100644
--- a/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
+++ b/kagenti-operator/config/samples/agent_v1alpha1_agentruntime_tool.yaml
@@ -13,8 +13,3 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: calculator-tool
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4318
-    protocol: http
-    sampling:
-      rate: 1.0
diff --git a/kagenti-operator/docs/api-reference.md b/kagenti-operator/docs/api-reference.md
index 5732870a..fa4030a2 100644
--- a/kagenti-operator/docs/api-reference.md
+++ b/kagenti-operator/docs/api-reference.md
@@ -378,7 +378,7 @@ For Deployments and StatefulSets to be automatically discovered by the operator,
 
 ## AgentRuntime
 
-The `AgentRuntime` Custom Resource configures identity (SPIFFE) and observability (OTEL traces) for agent and tool workloads. Unlike AgentCard, which handles discovery and metadata fetching, AgentRuntime provides runtime configuration for workload identity and telemetry.
+The `AgentRuntime` Custom Resource configures identity (SPIFFE) for agent and tool workloads. Unlike AgentCard, which handles discovery and metadata fetching, AgentRuntime provides runtime configuration for workload identity.
 
 ### API Group and Version
 
@@ -392,7 +392,7 @@ The `AgentRuntime` Custom Resource configures identity (SPIFFE) and observabilit
 AgentRuntime and AgentCard serve complementary purposes:
 
 - **AgentCard**: Fetches and stores agent metadata (capabilities, skills, endpoints) for dynamic discovery. Handles signature verification and identity binding validation.
-- **AgentRuntime**: Configures identity (SPIFFE trust domain) and observability (OTEL trace endpoints, sampling) for running workloads.
+- **AgentRuntime**: Configures identity (SPIFFE trust domain) for running workloads.
 
 Both resources use the shared `TargetRef` type to reference the backing workload (Deployment, StatefulSet, etc.).
 
@@ -400,7 +400,7 @@ Both resources use the shared `TargetRef` type to reference the backing workload
 
 The controller merges configuration from three layers (highest priority wins):
 
-1. **AgentRuntime CR spec** — per-workload overrides (trust domain, trace endpoint, etc.)
+1. **AgentRuntime CR spec** — per-workload overrides (trust domain, etc.)
 2. **Namespace defaults** — ConfigMap with `kagenti.io/defaults=true` label in the workload's namespace
 3. **Cluster defaults** — `kagenti-platform-config` ConfigMap in `kagenti-system`
 
@@ -413,7 +413,6 @@ The controller merges configuration from three layers (highest priority wins):
 | `type` | string | Yes | Classifies the workload as `agent` or `tool` |
 | `targetRef` | [TargetRef](#targetref) | Yes | Identifies the workload backing this runtime (uses the same TargetRef type as AgentCard) |
 | `identity` | [IdentitySpec](#identityspec) | No | Optional per-workload identity overrides |
-| `trace` | [TraceSpec](#tracespec) | No | Optional per-workload observability overrides |
 | `skills` | [][SkillImageRef](#skillimageref) | No | OCI skill images to mount into the agent pod as Kubernetes ImageVolumes. Requires the `skillImageVolumes` feature gate and Kubernetes 1.31+. Max 20 items. |
 
 #### IdentitySpec
@@ -430,22 +429,6 @@ Configures workload identity for an AgentRuntime.
 |-------|------|----------|-------------|
 | `trustDomain` | string | No | Overrides the operator-level `--spire-trust-domain` for this workload. If empty, the operator flag value is used. Must match pattern: `^[a-zA-Z0-9]([a-zA-Z0-9\-\.]*[a-zA-Z0-9])?$` |
 
-#### TraceSpec
-
-Configures observability for an AgentRuntime.
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `endpoint` | string | No | OTEL collector endpoint override |
-| `protocol` | string | No | OTEL export protocol (`grpc` or `http`) |
-| `sampling` | [SamplingSpec](#samplingspec) | No | Trace sampling configuration |
-
-#### SamplingSpec
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `rate` | float | Yes | Sampling rate (0.0-1.0, inclusive) |
-
 #### SkillImageRef
 
 Identifies an OCI skill image to mount into the agent pod as a Kubernetes [ImageVolume](https://kubernetes.io/docs/tasks/configure-pod-container/image-volumes/). Skills are packaged as OCI images following the [skillimage](https://github.com/redhat-et/skillimage) convention (`FROM scratch` with `skill.yaml` + `SKILL.md`).
@@ -551,7 +534,7 @@ spec:
     name: weather-agent
 ```
 
-#### Agent Runtime with Identity and Trace Overrides
+#### Agent Runtime with Identity Overrides
 
 ```yaml
 apiVersion: agent.kagenti.dev/v1alpha1
@@ -568,11 +551,6 @@ spec:
   identity:
     spiffe:
       trustDomain: custom.example.com
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4317
-    protocol: grpc
-    sampling:
-      rate: 0.1
 ```
 
 #### Tool Runtime
@@ -589,11 +567,6 @@ spec:
     apiVersion: apps/v1
     kind: Deployment
     name: calculator-tool
-  trace:
-    endpoint: otel-collector.observability.svc.cluster.local:4318
-    protocol: http
-    sampling:
-      rate: 1.0
 ```
 
 #### Agent Runtime with OCI Skill Images
diff --git a/kagenti-operator/docs/architecture.md b/kagenti-operator/docs/architecture.md
index d23a46eb..6c6a123d 100644
--- a/kagenti-operator/docs/architecture.md
+++ b/kagenti-operator/docs/architecture.md
@@ -41,7 +41,7 @@ The Kagenti Operator is a Kubernetes controller that implements the [Operator Pa
 #### AgentRuntime CRD
 - The declarative way to enroll a workload into the Kagenti platform
 - Developer creates an AgentRuntime CR with `targetRef` — the controller applies labels and triggers injection
-- Configures identity (SPIFFE) and observability (OTEL traces) per workload via 3-layer defaults (cluster → namespace → CR)
+- Configures identity (SPIFFE) per workload via 3-layer defaults (cluster → namespace → CR)
 - Uses `targetRef` to reference backing workloads (Deployment, StatefulSet)
 - The `kagenti.io/type` label applied by the controller triggers the webhook's `objectSelector`
 - Developer workloads only need a `protocol.kagenti.io/a2a` label — the controller applies `kagenti.io/type` and `managed-by` labels automatically
diff --git a/kagenti-operator/docs/authbridge-webhook.md b/kagenti-operator/docs/authbridge-webhook.md
index c8e2a526..a7daec8d 100644
--- a/kagenti-operator/docs/authbridge-webhook.md
+++ b/kagenti-operator/docs/authbridge-webhook.md
@@ -134,7 +134,7 @@ When the `perWorkloadConfigResolution` feature gate is enabled, the webhook reso
 ```
 ┌──────────────────────────────────────┐
 │ Layer 3: AgentRuntime CR overrides   │  ← highest precedence
-│   (spec.identity, spec.trace)        │
+│   (spec.identity)                    │
 ├──────────────────────────────────────┤
 │ Layer 2: Namespace ConfigMaps        │
 │   (authbridge-config, envoy-config,  │
@@ -178,9 +178,6 @@ When the `perWorkloadConfigResolution` feature gate is enabled, the webhook reso
 |-------------------|---------------------|-------------|
 | `spec.identity.spiffe.trustDomain` | `SpiffeTrustDomain` | SPIFFE trust domain |
 | `spec.identity.clientRegistration.realm` | `KeycloakRealm` | Keycloak realm (future — not yet in CRD) |
-| `spec.trace.endpoint` | `TraceEndpoint` | OpenTelemetry collector endpoint |
-| `spec.trace.protocol` | `TraceProtocol` | `grpc` or `http` |
-| `spec.trace.sampling.rate` | `TraceSamplingRate` | 0.0–1.0 sampling rate |
 
 **Non-overridable fields** (always from PlatformConfig or namespace CMs):
 - Container images, resource limits, proxy ports
diff --git a/kagenti-operator/docs/controller-webhook-interaction.md b/kagenti-operator/docs/controller-webhook-interaction.md
index 7747f017..db0f9542 100644
--- a/kagenti-operator/docs/controller-webhook-interaction.md
+++ b/kagenti-operator/docs/controller-webhook-interaction.md
@@ -59,7 +59,7 @@ sequenceDiagram
     participant WH as AuthBridge Webhook
     participant K8s as Kubernetes (ReplicaSet)
 
-    User->>API: kubectl patch AgentRuntime (e.g., change trace endpoint)
+    User->>API: kubectl patch AgentRuntime (e.g., change trust domain)
     API-->>Ctrl: Reconcile event
 
     Ctrl->>API: Get target Deployment
@@ -144,7 +144,7 @@ Both the controller and webhook perform the same 3-layer configuration merge ind
 ```
 ┌──────────────────────────────────────┐
 │ Layer 3: AgentRuntime CR overrides   │  ← highest precedence
-│   (spec.identity, spec.trace)        │
+│   (spec.identity)                    │
 ├──────────────────────────────────────┤
 │ Layer 2: Namespace defaults          │
 │   (ConfigMap with                    │
@@ -209,11 +209,11 @@ When a workload has `kagenti.io/type` labels applied manually (without an AgentR
 - The AgentRuntime override layer (layer 3) is skipped — configuration comes from PlatformConfig (layer 1) and namespace ConfigMaps (layer 2) only
 - No controller manages the config hash — configuration drift is not detected automatically, and changes to cluster/namespace defaults do not trigger rolling updates
 - The controller does not watch or reconcile these workloads
-- Per-workload identity (SPIFFE trust domain) and trace overrides are not available
+- Per-workload identity (SPIFFE trust domain) overrides are not available
 
 The AgentRuntime CR is the recommended approach because it provides:
 - Automatic rolling updates on config change (any layer)
-- Per-workload identity and trace overrides
+- Per-workload identity overrides
 - Status reporting (phase, conditions, configured pod count)
 - Graceful cleanup via finalizer
 
diff --git a/kagenti-operator/internal/controller/agentruntime_config.go b/kagenti-operator/internal/controller/agentruntime_config.go
index 0688f4f6..15b0fb12 100644
--- a/kagenti-operator/internal/controller/agentruntime_config.go
+++ b/kagenti-operator/internal/controller/agentruntime_config.go
@@ -54,14 +54,13 @@ const (
 // resolvedConfig is the canonical representation used for hash computation.
 // It captures the merged result of cluster defaults → namespace defaults → CR overrides.
 //
-// Structured fields (Type, TrustDomain, Trace) hold CR-level overrides.
+// Structured fields (Type, TrustDomain) hold CR-level overrides.
 // FeatureGates and Defaults hold the raw ConfigMap data. The hash is computed
 // from the full struct — the webhook performs the same merge independently
 // at Pod CREATE time.
 type resolvedConfig struct {
 	Type         string            `json:"type"`
 	TrustDomain  string            `json:"trustDomain,omitempty"`
-	Trace        *traceConfig      `json:"trace,omitempty"`
 	FeatureGates map[string]string `json:"featureGates,omitempty"`
 	Defaults     map[string]string `json:"defaults,omitempty"`
 	// AuthBridgeMode and MTLSMode change the injected sidecar shape /
@@ -87,8 +86,8 @@ type resolvedConfig struct {
 	// (single-digit agents) this is fine; in larger deployments,
 	// formatting / whitespace edits to this CM during peak hours will
 	// trigger a noticeable rollout fan-out.
-	AuthBridgeRuntime string `json:"authBridgeRuntime,omitempty"`
-	Skills            []skillConfig     `json:"skills,omitempty"`
+	AuthBridgeRuntime string        `json:"authBridgeRuntime,omitempty"`
+	Skills            []skillConfig `json:"skills,omitempty"`
 }
 
 type skillConfig struct {
@@ -98,12 +97,6 @@ type skillConfig struct {
 	PullPolicy string `json:"pullPolicy,omitempty"`
 }
 
-type traceConfig struct {
-	Endpoint string  `json:"endpoint,omitempty"`
-	Protocol string  `json:"protocol,omitempty"`
-	Rate     float64 `json:"rate,omitempty"`
-}
-
 // ConfigResult holds the computed hash and any warnings from the config resolution.
 type ConfigResult struct {
 	Hash     string
@@ -178,19 +171,6 @@ func resolveConfig(ctx context.Context, c client.Reader, namespace string, spec
 		resolved.TrustDomain = spec.Identity.SPIFFE.TrustDomain
 	}
 
-	if spec.Trace != nil {
-		resolved.Trace = &traceConfig{}
-		if spec.Trace.Endpoint != "" {
-			resolved.Trace.Endpoint = spec.Trace.Endpoint
-		}
-		if spec.Trace.Protocol != "" {
-			resolved.Trace.Protocol = string(spec.Trace.Protocol)
-		}
-		if spec.Trace.Sampling != nil {
-			resolved.Trace.Rate = spec.Trace.Sampling.Rate
-		}
-	}
-
 	resolved.AuthBridgeMode = spec.AuthBridgeMode
 	resolved.MTLSMode = spec.MTLSMode
 
diff --git a/kagenti-operator/internal/controller/agentruntime_config_test.go b/kagenti-operator/internal/controller/agentruntime_config_test.go
index 2e0a11bf..3a3dc08d 100644
--- a/kagenti-operator/internal/controller/agentruntime_config_test.go
+++ b/kagenti-operator/internal/controller/agentruntime_config_test.go
@@ -133,24 +133,6 @@ var _ = Describe("AgentRuntime Config", func() {
 			Expect(r1.Hash).NotTo(Equal(r2.Hash))
 		})
 
-		It("should change when trace config changes", func() {
-			spec1 := &agentv1alpha1.AgentRuntimeSpec{
-				Type:      agentv1alpha1.RuntimeTypeAgent,
-				TargetRef: agentv1alpha1.TargetRef{APIVersion: "apps/v1", Kind: "Deployment", Name: "hash-trace"},
-				Trace:     &agentv1alpha1.TraceSpec{Endpoint: "otel:4317", Protocol: agentv1alpha1.TraceProtocolGRPC},
-			}
-			spec2 := &agentv1alpha1.AgentRuntimeSpec{
-				Type:      agentv1alpha1.RuntimeTypeAgent,
-				TargetRef: agentv1alpha1.TargetRef{APIVersion: "apps/v1", Kind: "Deployment", Name: "hash-trace"},
-				Trace:     &agentv1alpha1.TraceSpec{Endpoint: "otel:4318", Protocol: agentv1alpha1.TraceProtocolHTTP},
-			}
-
-			r1, _ := ComputeConfigHash(ctx, k8sClient, namespace, spec1)
-			r2, _ := ComputeConfigHash(ctx, k8sClient, namespace, spec2)
-
-			Expect(r1.Hash).NotTo(Equal(r2.Hash))
-		})
-
 		It("should change when identity changes", func() {
 			spec1 := &agentv1alpha1.AgentRuntimeSpec{
 				Type:      agentv1alpha1.RuntimeTypeAgent,
@@ -376,7 +358,6 @@ var _ = Describe("AgentRuntime Config", func() {
 				Type:      agentv1alpha1.RuntimeTypeAgent,
 				TargetRef: agentv1alpha1.TargetRef{APIVersion: "apps/v1", Kind: "Deployment", Name: "merge-test"},
 				Identity:  &agentv1alpha1.IdentitySpec{SPIFFE: &agentv1alpha1.SPIFFEIdentity{TrustDomain: "my-domain.org"}},
-				Trace:     &agentv1alpha1.TraceSpec{Endpoint: "cr-collector:4317", Protocol: agentv1alpha1.TraceProtocolGRPC},
 			}
 
 			resolved, _ := resolveConfig(ctx, k8sClient, namespace, spec)
@@ -384,9 +365,6 @@ var _ = Describe("AgentRuntime Config", func() {
 			// CR overrides
 			Expect(resolved.Type).To(Equal("agent"))
 			Expect(resolved.TrustDomain).To(Equal("my-domain.org"))
-			Expect(resolved.Trace).NotTo(BeNil())
-			Expect(resolved.Trace.Endpoint).To(Equal("cr-collector:4317"))
-			Expect(resolved.Trace.Protocol).To(Equal("grpc"))
 
 			// Namespace overrides cluster
 			Expect(resolved.Defaults["otel-endpoint"]).To(Equal("ns-collector:4317"))
@@ -406,7 +384,6 @@ var _ = Describe("AgentRuntime Config", func() {
 
 			Expect(resolved.Type).To(BeEmpty())
 			Expect(resolved.TrustDomain).To(BeEmpty())
-			Expect(resolved.Trace).To(BeNil())
 		})
 
 		It("should not duplicate CR overrides in Defaults map", func() {
@@ -418,15 +395,10 @@ var _ = Describe("AgentRuntime Config", func() {
 			spec := &agentv1alpha1.AgentRuntimeSpec{
 				Type:      agentv1alpha1.RuntimeTypeAgent,
 				TargetRef: agentv1alpha1.TargetRef{APIVersion: "apps/v1", Kind: "Deployment", Name: "no-dup"},
-				Trace:     &agentv1alpha1.TraceSpec{Endpoint: "cr-collector:4317"},
 			}
 
 			resolved, _ := resolveConfig(ctx, k8sClient, namespace, spec)
 
-			// CR trace endpoint is in structured field
-			Expect(resolved.Trace).NotTo(BeNil())
-			Expect(resolved.Trace.Endpoint).To(Equal("cr-collector:4317"))
-
 			// ConfigMap value untouched in Defaults
 			Expect(resolved.Defaults["otel-endpoint"]).To(Equal("cluster-collector:4317"))
 		})
diff --git a/kagenti-operator/internal/controller/agentruntime_controller_test.go b/kagenti-operator/internal/controller/agentruntime_controller_test.go
index 73bd0176..15b9763c 100644
--- a/kagenti-operator/internal/controller/agentruntime_controller_test.go
+++ b/kagenti-operator/internal/controller/agentruntime_controller_test.go
@@ -467,7 +467,7 @@ var _ = Describe("AgentRuntime Controller", func() {
 		})
 	})
 
-	Context("When the AgentRuntime has identity and trace overrides", func() {
+	Context("When the AgentRuntime has identity overrides", func() {
 		var dep *appsv1.Deployment
 		var rt *agentv1alpha1.AgentRuntime
 
@@ -490,11 +490,6 @@ var _ = Describe("AgentRuntime Controller", func() {
 					Identity: &agentv1alpha1.IdentitySpec{
 						SPIFFE: &agentv1alpha1.SPIFFEIdentity{TrustDomain: "custom.org"},
 					},
-					Trace: &agentv1alpha1.TraceSpec{
-						Endpoint: "custom-collector:4317",
-						Protocol: agentv1alpha1.TraceProtocolGRPC,
-						Sampling: &agentv1alpha1.SamplingSpec{Rate: 0.5},
-					},
 				},
 			}
 			Expect(k8sClient.Create(ctx, rt)).To(Succeed())
diff --git a/kagenti-operator/internal/webhook/injector/agentruntime_config.go b/kagenti-operator/internal/webhook/injector/agentruntime_config.go
index 4d6331fa..82280b5d 100644
--- a/kagenti-operator/internal/webhook/injector/agentruntime_config.go
+++ b/kagenti-operator/internal/webhook/injector/agentruntime_config.go
@@ -48,11 +48,6 @@ type AgentRuntimeOverrides struct {
 	// Identity — from .spec.identity.allowedAudiences
 	AllowedAudiences []string
 
-	// Observability — from .spec.trace
-	TraceEndpoint     *string
-	TraceProtocol     *string  // "grpc" or "http"
-	TraceSamplingRate *float64 // 0.0–1.0
-
 	// AuthBridge deployment shape — from .spec.authBridgeMode
 	// Nil = no per-workload override; the namespace's
 	// authbridge-runtime-config mode (if set) or the cluster fallback
@@ -118,24 +113,6 @@ func extractOverrides(rt *agentv1alpha1.AgentRuntime) *AgentRuntimeOverrides {
 		overrides.AllowedAudiences = slices.Clone(rt.Spec.Identity.AllowedAudiences)
 	}
 
-	// .spec.trace.endpoint
-	if rt.Spec.Trace != nil && rt.Spec.Trace.Endpoint != "" {
-		ep := rt.Spec.Trace.Endpoint
-		overrides.TraceEndpoint = &ep
-	}
-
-	// .spec.trace.protocol
-	if rt.Spec.Trace != nil && rt.Spec.Trace.Protocol != "" {
-		p := string(rt.Spec.Trace.Protocol)
-		overrides.TraceProtocol = &p
-	}
-
-	// .spec.trace.sampling.rate
-	if rt.Spec.Trace != nil && rt.Spec.Trace.Sampling != nil {
-		rate := rt.Spec.Trace.Sampling.Rate
-		overrides.TraceSamplingRate = &rate
-	}
-
 	// .spec.authBridgeMode
 	if rt.Spec.AuthBridgeMode != "" {
 		mode := rt.Spec.AuthBridgeMode
@@ -151,7 +128,6 @@ func extractOverrides(rt *agentv1alpha1.AgentRuntime) *AgentRuntimeOverrides {
 	arConfigLog.Info("AgentRuntime overrides extracted",
 		"hasSpiffeTrustDomain", overrides.SpiffeTrustDomain != nil,
 		"hasClientRegistration", overrides.ClientRegistrationProvider != nil,
-		"hasTrace", overrides.TraceEndpoint != nil,
 		"hasAuthBridgeMode", overrides.AuthBridgeMode != nil,
 		"hasMTLSMode", overrides.MTLSMode != nil)
 
diff --git a/kagenti-operator/internal/webhook/injector/agentruntime_config_test.go b/kagenti-operator/internal/webhook/injector/agentruntime_config_test.go
index 823bee70..cfeef1ec 100644
--- a/kagenti-operator/internal/webhook/injector/agentruntime_config_test.go
+++ b/kagenti-operator/internal/webhook/injector/agentruntime_config_test.go
@@ -65,13 +65,6 @@ func TestReadAgentRuntimeOverrides_MatchesByTargetRef(t *testing.T) {
 					TrustDomain: "override.local",
 				},
 			},
-			Trace: &agentv1alpha1.TraceSpec{
-				Endpoint: "http://otel-collector:4317",
-				Protocol: agentv1alpha1.TraceProtocolGRPC,
-				Sampling: &agentv1alpha1.SamplingSpec{
-					Rate: 0.5,
-				},
-			},
 		},
 	}
 
@@ -97,17 +90,6 @@ func TestReadAgentRuntimeOverrides_MatchesByTargetRef(t *testing.T) {
 	if overrides.ClientRegistrationRealm != nil {
 		t.Errorf("expected nil ClientRegistrationRealm, got %v", overrides.ClientRegistrationRealm)
 	}
-
-	// Trace
-	if overrides.TraceEndpoint == nil || *overrides.TraceEndpoint != "http://otel-collector:4317" {
-		t.Errorf("TraceEndpoint = %v", overrides.TraceEndpoint)
-	}
-	if overrides.TraceProtocol == nil || *overrides.TraceProtocol != "grpc" {
-		t.Errorf("TraceProtocol = %v", overrides.TraceProtocol)
-	}
-	if overrides.TraceSamplingRate == nil || *overrides.TraceSamplingRate != 0.5 {
-		t.Errorf("TraceSamplingRate = %v", overrides.TraceSamplingRate)
-	}
 }
 
 func TestReadAgentRuntimeOverrides_PartialOverrides(t *testing.T) {
@@ -149,9 +131,6 @@ func TestReadAgentRuntimeOverrides_PartialOverrides(t *testing.T) {
 	if overrides.ClientRegistrationProvider != nil {
 		t.Errorf("expected nil ClientRegistrationProvider, got %v", overrides.ClientRegistrationProvider)
 	}
-	if overrides.TraceEndpoint != nil {
-		t.Errorf("expected nil TraceEndpoint, got %v", overrides.TraceEndpoint)
-	}
 }
 
 func TestReadAgentRuntimeOverrides_NoTargetRefMatch(t *testing.T) {
diff --git a/kagenti-operator/internal/webhook/injector/resolved_config.go b/kagenti-operator/internal/webhook/injector/resolved_config.go
index 7a259a28..6c0ae3c9 100644
--- a/kagenti-operator/internal/webhook/injector/resolved_config.go
+++ b/kagenti-operator/internal/webhook/injector/resolved_config.go
@@ -53,11 +53,6 @@ type ResolvedConfig struct {
 
 	// AuthBridge runtime config — from namespace "authbridge-runtime-config" ConfigMap
 	AuthBridgeRuntimeYAML string // raw config.yaml (base for per-agent ConfigMap)
-
-	// Observability — from AgentRuntime .spec.trace (optional)
-	TraceEndpoint     string
-	TraceProtocol     string   // "grpc" or "http"
-	TraceSamplingRate *float64 // nil = not set
 }
 
 // ResolveConfig merges all three configuration layers into a single ResolvedConfig.
@@ -94,7 +89,7 @@ func ResolveConfig(platform *config.PlatformConfig, ns *NamespaceConfig, ar *Age
 		AuthBridgeRuntimeYAML:      ns.AuthBridgeRuntimeYAML,
 	}
 
-	// Apply AgentRuntime overrides (highest precedence)
+	// Apply AgentRuntime identity overrides (highest precedence)
 	if ar != nil {
 		if len(ar.AllowedAudiences) > 0 {
 			resolved.AllowedAudiences = ar.AllowedAudiences
@@ -105,18 +100,6 @@ func ResolveConfig(platform *config.PlatformConfig, ns *NamespaceConfig, ar *Age
 		if ar.ClientRegistrationRealm != nil {
 			resolved.KeycloakRealm = *ar.ClientRegistrationRealm
 		}
-		// TODO: AdminCredentialsSecretName/Namespace overrides require reading a
-		// different Secret at namespace-config time (not a simple value override).
-		// Deferred until AgentRuntime CRD is merged and the full flow is testable.
-		if ar.TraceEndpoint != nil {
-			resolved.TraceEndpoint = *ar.TraceEndpoint
-		}
-		if ar.TraceProtocol != nil {
-			resolved.TraceProtocol = *ar.TraceProtocol
-		}
-		if ar.TraceSamplingRate != nil {
-			resolved.TraceSamplingRate = ar.TraceSamplingRate
-		}
 	}
 
 	return resolved
diff --git a/kagenti-operator/internal/webhook/injector/resolved_config_test.go b/kagenti-operator/internal/webhook/injector/resolved_config_test.go
index 52054cc0..6ec6fb81 100644
--- a/kagenti-operator/internal/webhook/injector/resolved_config_test.go
+++ b/kagenti-operator/internal/webhook/injector/resolved_config_test.go
@@ -94,27 +94,6 @@ func TestResolveConfig_SpiffeTrustDomain_AROverride(t *testing.T) {
 	}
 }
 
-func TestResolveConfig_TraceOverrides(t *testing.T) {
-	samplingRate := 0.75
-	ar := &AgentRuntimeOverrides{
-		TraceEndpoint:     ptr.To("http://otel:4317"),
-		TraceProtocol:     ptr.To("grpc"),
-		TraceSamplingRate: &samplingRate,
-	}
-
-	resolved := ResolveConfig(config.CompiledDefaults(), &NamespaceConfig{}, ar)
-
-	if resolved.TraceEndpoint != "http://otel:4317" {
-		t.Errorf("TraceEndpoint = %q", resolved.TraceEndpoint)
-	}
-	if resolved.TraceProtocol != "grpc" {
-		t.Errorf("TraceProtocol = %q", resolved.TraceProtocol)
-	}
-	if resolved.TraceSamplingRate == nil || *resolved.TraceSamplingRate != 0.75 {
-		t.Errorf("TraceSamplingRate = %v", resolved.TraceSamplingRate)
-	}
-}
-
 func TestResolveConfig_SidecarConfigs_NotOverridable(t *testing.T) {
 	ns := &NamespaceConfig{
 		SpiffeHelperConf:    "helper.conf content",
diff --git a/kagenti-operator/test/e2e/e2e_test.go b/kagenti-operator/test/e2e/e2e_test.go
index e27e8b4f..04af4704 100644
--- a/kagenti-operator/test/e2e/e2e_test.go
+++ b/kagenti-operator/test/e2e/e2e_test.go
@@ -1394,7 +1394,7 @@ rules:
 		})
 	})
 
-	Context("Identity and trace overrides", func() {
+	Context("Identity overrides", func() {
 		It("should produce a different config-hash than a minimal CR", func() {
 			By("deploying two target workloads")
 			_, err := utils.KubectlApplyStdin(runtimeMinimalTargetDeploymentFixture(), agentRuntimeTestNamespace)
@@ -1411,7 +1411,7 @@ rules:
 			_, err = utils.KubectlApplyStdin(runtimeMinimalCRFixture(), agentRuntimeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
-			By("creating AgentRuntime CR with identity and trace overrides")
+			By("creating AgentRuntime CR with identity overrides")
 			_, err = utils.KubectlApplyStdin(runtimeOverridesCRFixture(), agentRuntimeTestNamespace)
 			Expect(err).NotTo(HaveOccurred())
 
@@ -1455,7 +1455,7 @@ rules:
 
 			By("verifying config-hashes differ")
 			Expect(overridesHash).NotTo(Equal(minimalHash),
-				"identity/trace overrides should produce a different config-hash")
+				"identity overrides should produce a different config-hash")
 
 			By("cleaning up")
 			cmd := exec.Command("kubectl", "delete", "agentruntime", "test-minimal-runtime", "test-overrides-runtime",
diff --git a/kagenti-operator/test/e2e/fixtures.go b/kagenti-operator/test/e2e/fixtures.go
index 199bfd3c..40d15719 100644
--- a/kagenti-operator/test/e2e/fixtures.go
+++ b/kagenti-operator/test/e2e/fixtures.go
@@ -812,7 +812,7 @@ spec:
 `
 }
 
-// runtimeOverridesCRFixture returns YAML for an AgentRuntime CR with identity and trace overrides.
+// runtimeOverridesCRFixture returns YAML for an AgentRuntime CR with identity overrides.
 func runtimeOverridesCRFixture() string {
 	return `apiVersion: agent.kagenti.dev/v1alpha1
 kind: AgentRuntime
@@ -828,11 +828,6 @@ spec:
   identity:
     spiffe:
       trustDomain: custom.example.com
-  trace:
-    endpoint: "custom-collector.observability:4317"
-    protocol: grpc
-    sampling:
-      rate: 0.5
 `
 }