Session Replay
Session Replay reconstructs a completed session's audit trail as a forensic timeline: every tool call and LLM request, grouped into Steps and Phases, with playback controls and full-capture prompt/response viewing. Open it from the Replay tab on a session's full details page (select Open full details ↗ in the session panel), or jump straight there from an Audit Log event's detail view — its Session row has a view → link that opens the session's full details page and a replay → shortcut that opens it on the Replay tab, for a "something happened, find the session" workflow that doesn't require finding the session first.
Steps and Phases
Replay groups a session's raw events into two levels, so you can move between "what exactly happened" and "what was the agent doing":
- Steps — one model turn plus the tool calls it triggered. A retried LLM call (a route failover, or a transient upstream error followed by a successful retry) collapses into the same step, tagged retried, rather than appearing as a separate turn.
- Phases — windows of related Steps, labeled by the intent AIControls' context classifier detects. A new phase starts on a 45-second idle gap or once three consecutive Steps agree on a different intent.
The labels a Phase can get depend on the session's team's Domain, set per team in Settings → Teams:
- Development (the default) — exploration, feature development, refactoring, infrastructure change, running tests, or committing a fix.
- General — for teams whose work isn't coding: research, execution, or communication, based on the shape of the tools called (read/search-shaped tools count as research, write/send-shaped tools as execution, message/notify-shaped tools as communication).
A session's Domain is snapshotted from its team at the time the session is created, so retagging a team's Domain later doesn't change how already-recorded sessions are labeled.
Both levels are computed read-time from the session's complete, already-recorded event set — Replay is only available once a session has ended, since Steps and Phases are derived from events that have finished arriving. An in-progress session doesn't yet have a Replay tab.
Grid and Conversation views
- Grid — a dense table (styled after a browser network panel, in chronological order): one row per Step or event, with columns for time, kind, name, resource, decision, cost, and latency. A detail panel alongside it breaks down whatever's selected across five tabs: Context, Arguments, Policy, Timing, and Chain (the causal sequence of calls leading up to it).
- Conversation — a chat-style transcript: one turn per Step, prompt and response bubbles, tool calls inline, grouped under their Phase.
A brushable overview strip above both views shows event density, severity, and context-pressure over time — drag across it to scrub, or click a marker to jump to a flagged finding.
Playback
A transport bar steps through the session one Step (or event, or Phase, depending on the selected grouping level) at a time, or plays it back automatically at 1×, 4×, 16×, or 64× speed. Play needs at least two rows at the current grouping level, so it is disabled when there is only one. For example, a Conversation view with a single Step has nothing to play through; switch to Grid with All events grouping to play through that Step's events. Keyboard shortcuts (arrow keys to step, space to play/pause) work anywhere on the page except inside a text filter. Playback drives the detail panel: whichever row the transport cursor is on is what the Context/Arguments/Policy/Timing/Chain tabs describe.
Full Capture Viewer
When full capture is enabled, a View full capture button (in both Replay and the Audit Log's own event detail) opens the complete, untruncated prompt, model reasoning, and response for that LLM call — not just the always-truncated prompt snippet stored inline on the event. The viewer shows one turn per page (prompt, then reasoning if present, then response), with Prev/Next to step through the rest of the conversation without closing it, a Load full conversation mode that steps through every turn in order, and a JSON export of everything loaded.
The first turn captured for a conversation shows its full prompt (system instructions plus history to that point); every turn after that shows only what's newly added since the previous captured turn, not the whole growing history again — the earlier turns' own pages already have the rest. This keeps storage proportional to what a session actually adds turn over turn rather than to the conversation's full length each time, without losing anything: reading turn-by-turn in order reconstructs the complete conversation exactly as reading the old whole-history-per-turn view did.
Full capture content is redacted the same way as every other audit record — credentials and personal data are stripped before it's ever written to storage — but never truncated.
Occasionally a turn shows "Full capture was attempted... but dropped" instead of its content — the capture pipeline is asynchronous and best-effort by design (it never adds latency to the request it's attached to), so a burst of concurrent calls can occasionally exceed its processing capacity. This never affects the LLM call itself or the rest of that turn's audit record, only the untruncated full-text copy for that one turn.
Findings
Replay surfaces a small set of notable events as findings — a denied or held call, a shadow-deny, or a detected mismatch between the session's activity and its declared ticket — as markers on the overview strip and jump targets in the Conversation view, so a reviewer can go straight to what's notable in a long session rather than scrolling through everything.
Large sessions
Replay derives Steps, Phases, and the overview strip from up to 5,000 events per session. A session with more is truncated: the tab shows a banner naming the cutoff, and the JSON export is marked partial rather than presented as a complete record. This bound exists because Steps/Phases/overview-strip derivation runs on every request rather than being cached — it keeps derivation fast (low tens of milliseconds even near the cutoff) at the cost of not covering an unusually long session's tail. Sessions this long are uncommon; if you regularly hit the limit, tell your AIControls contact.