Audit lenses

The platform records every material action once. The audit list and the detail page summarize it in plain language. On the detail page, three lenses show the same record for different readers:

Engineering: every recorded entry, with its payload.
Auditor: a per-execution certificate and risk rubric, for work item task flows and runs spawned from a work item today.
Cost: the model usage of a work item.

Audience: risk and compliance reviewers and IT (the enabler)

What gets recorded

Every action the platform takes against your data leaves an audit ledger entry. The ledger covers tool calls, file reads and writes, integration calls, runs, publishes, credential changes, configuration changes, prompt and response payloads, work item lifecycle events, and external triggers. Each entry carries an actor_id, occurred_at, family, direction, action, subject, request_id, and a five-valued status. Lineage links bind entries together so a run can be traced back to the work item, conversation, Project, or schedule that produced it.

The audit list and detail page

The audit list lives at /audit. Each row has five columns: Activity, Surface, Started, Duration, and Result. Activity shows the title on one line, and the Project, the context, and the actor on a second line. Surface names the Project or work item the action belongs to. Result shows the status. Succeeded and cancelled read neutral, so color marks only problems: red for failed, yellow for blocked, and orange for degraded. The summary is plain language: "Run completed", "Published verified query", "Sent reply via Gmail".

Click a row to open the detail page in place. The hero pins the surface, group id, status pill, lead, secondary summary, actor block, lineage trail, and a fact grid (Actor, When, Origin, Family, Direction, Action, Request, counts). This is the layer an auditor or analyst can read without engineering vocabulary.

The engineering lens

The Engineering lens shows one expandable row per recorded entry. Each row shows its offset from the start of the run, for example +14.46s. On a work item execution, each step shows when it started and how long it ran. The records of the agent run a step started (prompt, tool calls, logs, and file changes) are nested under that step.

Expand a row to see its details: the content for its kind (such as a tool call's code or a file change), the before and after state, its status and attributes, and its entry, request, and trace IDs. The full entry is in a Raw record disclosure. This is the layer an engineer uses to reproduce a bug or trace a tool call to a specific argument.

The lens header has a Failures only chip, a Show debug chip that reveals LLM reasoning and log emissions hidden from the default scan, and one Collapse all or Expand all toggle.

The status taxonomy is five-valued

Status is one of succeeded, failed, cancelled, blocked, or degraded. They are not interchangeable, and triage paths differ:

Succeeded. The code path completed without error and produced its expected output.
Failed. The code path errored. Something the platform tried to do raised an exception. Engineering triage.
Cancelled. The run was stopped before it finished. Nothing errored.
Blocked. A guardrail, approval gate, or missing credential held forward progress. Nothing errored; the platform refused to proceed. Policy or governance triage.
Degraded. Forward progress completed, but a secondary signal regressed (a downstream call timed out, a retry succeeded after failures, a partial result was returned). Observability triage.

Failed is not the same as blocked. Failed means a code path errored. Blocked means the platform refused to proceed under policy. The result tints differently (red for failed, yellow for blocked, orange for degraded, while succeeded reads neutral) and the triage owner is different. Do not collapse them in your control narrative.

Filtering and deep links

The audit page filters through the URL so any view is shareable. The contract:

?hours=1|24|168|720 selects the time window (1h, 24h, 7d, 30d). Default 24.
?view=overview|conversations|work_items|data_work|files|config|all selects the category. overview is the default and covers project, configuration and work item activity; files and all reach the snapshot-level evidence beneath it.
?group=<group_id> opens the detail in place.
?actor=<actor_id> filters server-side to one actor. Used by the Users page View activity action.
?connection_id=<id> filters to a single data connection.
?project=<project_id> filters to one Project.
?archived=true shows only activity for archived work items.

One toolbar sits under the view tabs. It has a search box (Search activity or people), the time window, a Project picker, an actor picker, and two chips. Failures only keeps the loaded rows whose status is failed, blocked, or degraded. Archived only sets ?archived=true. Each chip shows how many rows it would leave.

The list loads the newest activity first. Scroll past the end to load older activity in the selected time window.

The Auditor lens is partial today

The detail surface includes an Auditor tab in addition to Engineering. Today the Auditor lens renders only for work item task flows and runs spawned from a work item; it shows a certificate, a risk rubric, and processing steps. For every other group kind the Auditor tab is disabled with a "Soon" pill. Where you need a certificate today, sample on work item flows. The audit list, the detail page, and the Engineering lens are available on every group kind regardless.

The Cost lens

The Cost tab sits next to Auditor, with the subtitle Tokens by model and purpose. Like Auditor, it is available for work item task flows and runs spawned from a work item, and shows a "Soon" pill elsewhere. It shows the model usage of the work item:

Usage totals: total tokens, the input and output split, and the Estimated cost.
By model: tokens and estimated cost per model, with No price for a model that has no known price.
By purpose: what the tokens were spent on, such as workflow agent steps, prompts from agent code, and audit step summaries.

The usage scope switch shows All executions of the work item by default, or This execution only. The totals include work the platform did for the item, such as step summaries. When part of the usage is older than its retention period, the total reads Recorded tokens and a note says so. When all of it is, the tab shows Older usage is unavailable. ?lens=cost opens the Cost tab directly.

Audit and evidence Deterministic execution