Audit Log
Every request that passes through AIControls is recorded — the identity, the tool or model, the governance decision, and the outcome. The Audit Log is your authoritative trail for security review, incident investigation, and compliance evidence.
What is logged
Every event in the audit log captures:
| Field | Description |
|---|---|
| Timestamp | UTC time of the request |
| Identity | Developer email or agent ID, plus team membership at the time of the request |
| Request type | MCP tool call or LLM request |
| Tool / Model | The MCP tool name (e.g. bash, read_file) or model identifier (e.g. claude-sonnet-4-6) |
| Server | The MCP server (datasource) the tool call targeted, e.g. github-mcp. Empty for LLM requests. |
| Decision | Allow, Deny, Audit, Warn, Warn Ask, or Warn Approve (shown as Pending, awaiting HITL approval) |
| Policy | The policy rule that produced the decision, if any |
Binding (binding_name) | The Access Binding that permitted or governed this request, when the decision was reached through a team→server binding rather than a hand-written policy alone |
Grant ID (grant_jti) | JWT ID of the Cross-App Access grant that authorized the call, when the request arrived via XAA/ID-JAG — ties the event back to the specific token exchange |
| Resource | File path, repository, namespace, or other resource accessed |
| Tokens / Cost | Token count and estimated cost for LLM requests |
| Session | The session this request belongs to |
MCP tool calls and LLM requests are stored in the same log. The Audit Log page (Security → Audit) filters by identity, decision, tool or model, request type, and time range; clicking any row opens the full event detail, including request arguments and the policy evaluation trace.
Decisions
Each event records a decision — the outcome of evaluating the request against your policies, such as Allow, Deny, Audit, Warn, Warn Ask, or Warn Approve (shown as Pending). The decision is what turns a raw log line into a governance record: it tells you not just that a request happened, but whether it was permitted, blocked, flagged for review, or routed to a human approver, and which policy rule produced that outcome. See Decision Types for the full set of decisions and their meanings.
Retention and export
Audit events are stored in your workspace's SQLite database. The default retention window is 90 days; older events are purged automatically. To extend retention, configure an S3-compatible object store in Settings → Integrations — events are streamed there in real time and retained indefinitely.
Export the current filtered view to CSV from the Audit Log toolbar. The export includes all fields in the table view and can be used directly for compliance reporting.