Model call audit
Every model call through the gateway is recorded as a Model Call event you can review in Agent Trail.
If you don't see this feature in your console, ask your SecureAuth contact to
enable the llm_gateway feature flag for your organization.
When a rule blocks a model call or a provider fails one, you need a record of who called which model and what happened. The gateway records each model call it handles as a Model Call event in Agent Trail, including calls a rule denied.
What a record holds
Each record names the agent instance, the user, the model, when the call started, and how long it took. When a model rule decided the call, the record names that rule. The outcome is one of completed, denied, upstream error, client cancelled, or gateway error. Agent Trail highlights a denied model call, because a rule refused it. A stream that stops partway is still recorded.
Find model calls
Open Agent Trail to see model calls beside tool calls and connections. On a user's page, the LLM Usage tab links to an agent's gateway calls in Agent Trail, refused ones included. Completed gateway calls also count toward LLM usage on Cost & Adoption, and a session the gateway served counts once.
To change which calls are denied, edit your model access rules.