Activity & SIEM
Two append-only ledgers: one for calls, one for changes to the rules themselves. Both are filterable in the dashboard and both export to your SIEM.
The call ledger
A row per call, allowed or not: the person, the agent and the host it came from, the connection, the tool, the outcome, and the reason. Filter by any of them.
- posthog__query_insightsdana@acme.comClaude CodeAllowedby policy
- linear__create_issuedana@acme.comClaude CodeAllowedapproved once by morgan@acme.com
- metabase__execute_sqlsam@acme.comCursorAskedwaiting for a person
- github__delete_reposam@acme.comCursorBlockedtool is set to Block
| Outcome | Meaning |
|---|---|
| Allowed | The call ran. The row says whether by policy, approved once, or remembered. |
| Asked | The call is paused, waiting for a person. |
| Denied | A person said no, or nobody answered in time. |
| Blocked | Policy refused it before anything downstream was touched. |
Every refusal carries a reason:
| Reason | Shown as |
|---|---|
blocked | tool is set to Block |
no_policy | tool not offered |
scope_unresolved | couldn't scope the call |
ask_pending | waiting for a person |
ask_denied | a person said no |
ask_expired | no one answered in time |
connection_disabled | connection disabled |
The governance ledger
Every change to the governance config: mode and preset changes, connections added or disabled, credentials rotated, approvals remembered or revoked, agents revoked. Each row names the human who made the change and carries a before/after diff.
Export to your SIEM
Configure a destination in Settings → Advanced. Two kinds are supported today:
- HMAC-signed webhook: we POST batches to your URL with a signature header you verify the way you verify a Stripe webhook. Secrets rotate with an overlap window.
- Splunk HEC: events go to your HTTP Event Collector with the token and index you configure.
Three versioned streams (decisions, governance, sessions) are delivered in order and at least once, on a cadence of about five minutes. Each destination keeps its own cursor per stream, so a receiver that was down catches up rather than skipping.
Test-send from the dashboard delivers a synthetic event of each stream so you can confirm your receiver before real traffic depends on it.