Review the audit log
/audit is the answer to “what did my agents do?” Every action, attempt, approval, and denial lands here.
Page layout
- Title: Audit Log
- Subtitle: “Record of every governed agent action. Auto-refreshes every 10 seconds.”
- Two tabs: Actions (default) and Policy Decisions — see Policy decisions tab
Top-right shows {N} entries (or {N} of {total} if your filters matched more than 1,000 rows and the dashboard truncated).
Filters
| Filter | What it does |
|---|---|
| From / To | Date range — limits to rows in that window |
| Agent | Multi-select dropdown of all agents under your account |
| Action | Multi-select dropdown of distinct action strings (scopes that have appeared in your audit log) |
| Reach | Any / Internal / External / Unknown — whether the call reached outside your organisation. Kept in the URL as ?reach= |
| Search | Free text — matches against agent, platform, action |
Filters compose. All five can be set simultaneously.
What each row shows
In the table view:
- Time
- Agent
- Platform
- Action (the scope or admin action)
- Result —
allowed,pending_approval,denied,error(with appropriate badge colour)
Click any row to open the detail modal.
The detail modal
Header: AUDIT ENTRY (small) and the action (large), with the entry’s UUID as subtitle.
Body shows:
- Time
- Result (badge)
- Agent
- Platform
- Scopes used (as pill badges)
- Forensics section (Enterprise + opt-in only): IP, geo (city, country), ASN, user agent, request ID, session
- Metadata section (when present): the JSON metadata blob — reason for denial, approval queue ID if relevant, circuit-breaker failure count, etc.
The correlation_id (also called request_id in some places) is what you copy when filing a support ticket or tracing across proxy logs.
Truncation note
If a date range / filter combination matches more than 1,000 rows, the dashboard shows the most-recent 1,000 and warns:
“Showing the most recent 1,000 of
{total}matching rows. Narrow the date range or add filters to see older entries.”
Use a tighter date range to see older rows, or export for offline analysis.
Export
On Team and Enterprise, four export buttons appear next to the filter bar:
- Export CSV
- Export JSON
- Export PDF — opens a print-ready page in a new window; use your browser’s print dialog to save it as PDF
- Compliance CSV — a server-generated export for auditors, with policy and forensic columns. Admin-only; it uses the date range and, when exactly one agent is selected, that agent
Each export respects the current filter set — so set up the view you want first, then export. CSV and JSON exports are capped at 10,000 rows; if more match, a prompt offers to narrow the date range or Export anyway (the most recent 10,000).
Below Team, the buttons are disabled with a tooltip (“Export available on Team plan”).
Retention by plan
| Plan | Shown in the dashboard |
|---|---|
| Free | 3 days |
| Solo | 30 days |
| Studio | 90 days |
| Team | 365 days |
| Enterprise | Unlimited |
A daily job deletes rows older than your plan’s window, with a 90-day floor: nothing younger than 90 days is ever deleted. On Free and Solo, rows past the plan window but inside 90 days still appear, dimmed and not clickable. If you need a longer window, upgrade — the data isn’t recoverable once purged.
Forensics fields
Enterprise customers can flip forensics_enabled on their org to capture IP, user-agent, geo, session, and request ID per row. Off by default; the consent decision is itself audited. See Audit & revocation for the privacy model.