Inspect policy decisions
The Policy Decisions tab on /audit lists AuthZEN evaluations: the times an agent (or another client) asked AgentValet “would this action be allowed?” by calling authzen_evaluate or POST /v1/authzen/access, before doing it. Each row is one of those questions and the answer the proxy gave.
It does not list ordinary governed calls or their denials. A use_platform call that was denied shows up on the Actions tab, with the reason in its metadata.
Open the tab
/audit → click Policy Decisions tab.
If no evaluations have been made yet, you’ll see:
“No policy decisions yet. AuthZEN evaluations appear here when agents make requests.”
That’s normal — plenty of agents never call the evaluator and only make governed calls.
What each row shows
The tab shows the most recent 200 evaluations, newest first, and refreshes every 10 seconds.
| Column | Meaning |
|---|---|
| Time | When the decision was made |
| Subject | The agent that asked (the last segment of the subject id; hover for the full value) |
| Action | The action being evaluated |
| Resource | The platform and scope being evaluated |
| Decision | ALLOW or DENY |
| Reason | The permission check’s reason, e.g. scope_not_granted, denied_by_policy, denied_by_guardrail, grant_expired, agent_suspended, circuit_breaker_open |
Rows aren’t clickable and the tab has no filters of its own; the Actions tab’s filters don’t apply here.
When you actually use this
- An agent says it was told “no” before trying. Find its evaluation here. The Reason tells you which check fired:
scope_not_grantedmeans the agent doesn’t hold that scope;denied_by_policyordenied_by_guardrailmeans a policy or guardrail blocked it;agent_suspendedmeans the agent is suspended. - You suspect circuit breaker false positives. Look for
circuit_breaker_openin the Reason column. That reason means the agent’s circuit breaker is open after repeated failures. It recovers on its own after a 5-minute cooldown, or you can use Reset circuit breaker on the agent’s page. - You’re integrating AuthZEN with another system. This log is your reference for what decision strings AgentValet emits — useful when wiring your own evaluator on top.
Difference from the Actions tab
Both tabs read the same audit log. The Actions tab shows what happened to real requests: executed, denied, queued for approval, failed. The Policy Decisions tab shows only the explicit pre-flight questions (authzen_eval rows). For debugging a denied call, start on the Actions tab.