Audit & Traceability
Event reference
Every event type Agent Trail records.
This page lists the kinds of events Agent Trail records. Use it when you search the audit log or choose which events a webhook forwards.
Agent activity
- Tool calls – each tool call, with the tool, the MCP server, and whether it ran or was denied.
- Tool errors – failed tool calls, with the error type.
- Tool searches – each tool search and the tools it returned, without the query.
- Redactions – which response filters redacted a tool response, and how many spans each matched.
- Model calls – each call through the AI gateway, recorded as a Model Call.
- Agent connections – a connection event each time an agent starts an MCP session, with client metadata.
Configuration changes
Agent Trail records changes to agents, MCP servers, policies, connections, response filters, tags, webhooks, telemetry ingest keys, and seat prices. A tools synced event lists the tools an MCP server added or changed. Events with field changes show the fields before and after.
Detection
Anomalies are recorded when they are detected, escalated, resolved, or triaged.
A status change on an NHI finding is recorded as nhi_finding.status_changed.
Retention
The audit store keeps three months of events. See Archive and retention to keep them longer.