Read the audit

Audit is every call through this workspace: when, who asked, the tool, the connection, the tier, how it was decided and how it went, including the console's own Probe of a connection, marked as the console's. It never holds a result, and the arguments are as the agent masked them.

• The chips above the table narrow it: When (the last 24 hours, 7, 30 or 90 days, or all the plan keeps), Who, Tool, Connection, Tier, Decision (allowed, denied at the gateway, or denied on the agent), Outcome and Personal data (shown, masked, or none in the answer). Clear removes them all.
• Days. Rows are grouped by day in your workspace's timezone, newest first, two hundred at a time; Older loads more. Sorting by a column sets the days aside.
• A row opens in the inspector: who and through what (the gateway, an agent's own MCP server or its command line), the decision's reason, how long it took and how much it returned, the arguments, and when the row leaves the audit.
• Export downloads the rows the chips keep as CSV, for a spreadsheet, or JSON, up to 50,000. Values are masked again on the way out, and a cell a spreadsheet would run as a formula is led by an apostrophe.

How long. Solo keeps 7 days, Team 90, and Enterprise as its contract sets, a year by default; the line under the table says how many days this workspace keeps. An hourly sweep deletes what is older. Rows within a day of leaving are counted in a band above the table, with Export them now.