Security Events
Security Events is a single, query-time view over everything security-relevant that happens in your workspace — policy decisions, egress blocks, approvals, exceptions, content-safety findings, and behavioral alerts — in one timeline instead of scattered across separate pages.
Where it lives
Security → Events in the admin console. Its All activity tab shows every request AIControls has evaluated — the same rows the former Audit Log page showed — filterable by identity, decision, tool or model, request type, and time range. Other tabs narrow the same underlying log to one event type at a time (for example, just approvals or just content-safety findings).
Links to the old /audit URL redirect to All activity (/security-events?tab=all) automatically.
Event types
| Event type | Meaning |
|---|---|
policy_denial | An MCP tool call or LLM request was blocked by a CEL policy or budget rule |
egress_denied | An outbound HTTP(S) call was blocked by network egress filtering — the always-on SSRF floor or an egress policy |
approval_required | A request was paused and parked in the Approvals queue pending human review |
hitl_approved | A reviewer approved a held request in the Approvals queue. Records who decided, not how the call itself was later dispositioned |
hitl_denied | A reviewer denied a held request in the Approvals queue, or a self-approval attempt was rejected |
exception_requested | A developer requested a config exception (a temporary deviation from an enforced setting) |
exception_granted | An exception request was approved, in full or in part |
exception_denied | An exception request was rejected |
exception_revoked | A previously granted exception was revoked before it expired |
exception_expired | A granted exception reached its expiry without being revoked |
content_safety_finding | The content-safety scanner detected PII, a credential, or a prompt-injection pattern in a prompt, tool argument, or response |
session_anomaly | A session's behavior deviated from its established baseline (unusual tool sequence, volume, or timing) |
baseline_alert | An identity's behavioral baseline itself changed enough to raise an alert (drift in normal usage patterns) |
ungoverned_mcp_server | An MCP server received traffic through the proxy but was never registered — see MCP Governance |
runtime_dns | The kernel observed a workload resolve a DNS name. See the caveats below — a resolution is not a connection |
runtime_network | The kernel observed a workload open a network connection to a destination |
runtime_open | The kernel observed a workload open a file path |
runtime_exec | The kernel observed a workload execute a binary |
Runtime observations
The four runtime_* types are kernel observations, not policy decisions. Nothing was denied; the sensor recorded that something happened. They appear only when the runtime integration is enabled, and they carry the Runtime scope facet.
Three things about them are easy to misread:
- A resolution is not a connection.
runtime_dnsproves a workload looked a name up. It does not prove any traffic followed. It is strictly weaker evidence thanruntime_network, and the UI marks it as such — never treat the two as interchangeable. - Suppressed destinations are not bypasses. Cluster DNS, the API server, in-cluster traffic, package registries and service-mesh control planes are suppressed from bypass accounting, and each suppressed row states its reason in the detail drawer. AIControls' own upstream calls are excluded too — the gateway is an in-cluster hop, not a workload bypassing governance.
- No findings is not "clean". When the detail drawer reports a non-zero ingest lag, kernel observations recorded by the sensor are not yet (or never will be) reflected in stored findings. A lost observation is indistinguishable from a workload that did nothing, so treat quiet workloads as possibly incomplete.
Aggregate views — per-node sensor coverage, and the per-workload kernel-vs-gateway reconciliation — are not events and stay on their own page. Clicking a workload there opens Security → Events filtered to that workload's observations.
Exception lifecycle events (exception_*) and approval decisions (hitl_approved, hitl_denied) are workflow bookkeeping, not call dispositions — see Quiet confidence for how these are excluded from that metric. In particular, a reviewer denying a held request is not counted as a denial against that reviewer in deny-rate figures or the "most-denied user" ranking in the admin digest.
API
curl "$YOUR_WORKSPACE_URL/api/v1/security-events" \
-H "Authorization: Bearer $ADMIN_TOKEN"
Requires an admin or viewer role. Supports the same identity, decision, event-type, and time-range filters as the UI.
| Query parameter | Effect |
|---|---|
eventType | Comma-separated event types from the table above |
plane | Comma-separated scope facets: mcp, llm, egress, content, session, inventory, runtime |
severity | Comma-separated severities |
agent, session | Exact-match identity filters |
workload | Exact-match Kubernetes workload key (<namespace>/<kind>/<name>). Only runtime_* events carry one |
search | Case-insensitive substring match across the summary and policy name |
from, to | ISO date (2026-08-01) or RFC 3339 timestamp |