Audit log

Every recorded action across your organization — who performed it, what it touched, and how it turned out — lands as an append-only event in Settings → Audit Log. Tool calls, policy edits, secret writes, role changes, schedule triggers, and approval decisions all arrive in the same stream, with the actor attached.

Anatomy of an event

Each event records an action (like tool.execute or policy.update), the resource it touched, an outcome — Succeeded, Denied, or Failed — and one of three actor kinds:

Expanding a row shows the full context: summary, timestamp, actor, outcome with duration, the resource with a deep link (View run, View policy, Manage secrets…), the originating IP and user agent for dashboard actions, the error message on failures, and a technical-details block with the raw action, service, and event IDs. Executions that ran under a human approval carry an Approved badge.

Events survive their subjects — deleting a role or archiving an agent never removes the history that mentions it. Sensitive values (keys, tokens, prompts, payloads) are redacted before an event is written; the log records that a secret changed, never what it changed to. There is no retention cut-off: events are kept indefinitely.

Filtering

The page filters compose: a date range (today / 7 days / 30 days / all time, or a custom range), who acted (everyone, users, agents, system), a specific actor, a category, and an outcome. Categories group the event types:

• Agent & tool activity — tool executions and denials
• Sessions — session lifecycle
• Team & access control — members, roles, policies, delegation
• Secrets & credentials — provider keys and MCP credentials
• Schedules & triggers — Task Agent schedules, runs, and webhooks
• MCP registry — server enablement and configuration
• Identity — identity session issuance and revocation

Two filters answer most governance questions directly: Outcome: Denied shows every action policy stopped, and Who: Agents shows everything agents did on people’s behalf.

The stat tiles are the dashboard

Above the event list, five tiles summarize whatever the current filters select: Events, Active actors, Agent-driven (the share of events performed by agents rather than people), Denied, and Failed — with a daily chart splitting activity between people and agents. Scoped to 30 days, this is the at-a-glance governance view: how much is running, how much of it is autonomous, and whether policy is doing any work.

For cost rather than conduct, Usage (in the sidebar, outside Settings) breaks token consumption down by agent, model, and tool.