Audit events
Every agent emits structured security events - tool calls, egress decisions, quota denials - that surface in the platform's Security area.
Everything security-relevant an agent does is recorded. The agent runtime emits a structured audit event for each notable action — every tool call, every allowed or blocked outbound request, every authentication decision, every quota denial — and streams them to the platform, where they appear in the Security area filtered by organization, workspace, and agent.
What gets recorded
The audit stream covers the full lifecycle of agent activity:
- Task lifecycle — a session starting and ending, and each model call with its token usage (the basis for usage and cost reporting).
- Tool activity — every tool the agent invokes, with timing and input/output sizes.
- Egress decisions — each outbound request, allowed or blocked, with the domain and the policy mode that decided it.
- Policy and guardrail decisions — content that was masked, warned on, or blocked, and commands denied by organization-wide policy.
- Approvals — a paused tool call, the human decision (with approver identity), or the timeout.
- Admission denials — requests turned away because a cost or usage quota was exhausted at the agent, workspace, or organization level.
- Authentication — every inbound request accepted or rejected, and by which identity.
Events are metadata by default: tool names, domains, durations, token counts, sizes — not prompt text, tool arguments, or results. Payload capture is a deliberate, per-agent opt-in for debugging or compliance needs, with secret-shaped values redacted.
Event naming
Event types follow a <entity>_<verb> shape: the prefix names the thing
the event is about, the verb what happened to it. The prefix matters — it
encodes where in the pipeline the decision was made.
| Event | Meaning |
|---|---|
tool_exec | The agent executed a tool |
egress_blocked | An outbound request was stopped by the egress allowlist |
egress_allowed | An outbound request passed the egress allowlist |
task_admission_denied | A new task was refused before execution because a quota (cost or token limit) was exhausted — with the scope, the window (hourly, daily, monthly), and when it resets |
task_deferred | A tool call was paused for human approval |
guardrail_check | A guardrail masked, warned on, or blocked content |
llm_call | A model call completed, with token usage |
For example, task_admission_denied is distinct from a per-tool or
per-call denial: the task_ prefix tells you the gate fired before any
work started, not midway through a tool.
Correlation and attribution
Every event carries identifiers that make the stream navigable:
- A correlation ID groups all events of one invocation — the authentication, the model calls, the tool calls, and the completion form a single timeline.
- Sequence numbers within an invocation let consumers detect missing or reordered events.
- Workflow identifiers tag events produced during a workflow run, so cost and activity roll up to the specific workflow, stage, and step that caused them.
- Tenancy fields stamp each event with the organization and workspace the agent is deployed in.
Events are also chained — each one carries a hash of the previous one — so gaps or tampering in the stream are detectable.
Where events surface
Agents publish their audit stream to the platform, and the Security area is where you consume it: browse and filter security events, see posture rollups such as top quota hits and policy denials, and review usage derived from the token counts on model call events. You do not need to access an agent's logs directly — the platform view is the operational surface.