Agentic Data Plane
Preview

Review the Audit Log

The audit log records authorization decisions across Agentic Data Plane. Use it to answer who performed an action, which resource they acted on, where the request came from, and whether the request was allowed or denied.

After reading this page, you will be able to:

  • Filter authorization events with the search bar, the Fields panel, and the time range

  • Inspect the actor, operation, resource, source, and policy behind an authorization decision

  • Choose the audit log or a transcript for an investigation

The audit log is a preview capability. It appears for every Agentic Data Plane environment, and two independent conditions govern what you see: your account needs the permission listed in the Prerequisites section, and the deployment needs audit recording enabled.

Because they are independent, a deployment can show the page with no recorded events. If the table is empty for a period you know had activity, see Troubleshoot the audit log.

Prerequisites

Your account needs the dataplane_adp_auditlog_list permission to open the audit log and view event details. If you don’t have the Admin role, audit log reads come from a built-in template, such as Read only, or from an access policy naming Action::"AuditLog.list". See Audit log permissions.

Audit events can include user identities, resource names, network information, configuration changes, and captured request or response data. Grant audit log access only to people who need it, and review events before sharing them.

Open the audit log

  1. Open Audit log in the sidebar.

  2. Review the most recent events. The default time range is Last 24 hours, and the newest event is first. The table loads more events as you scroll toward the end.

  3. Select a row to expand it, then click Open event details.

By default, the table shows these columns:

Column Description

Time

When the decision occurred, as an RFC 3339 timestamp in UTC. Hover over it to see the relative time.

Actor

The identity that made the call. When an agent made the call, the cell shows the agent’s name and the identity accountable for the call, such as the user the agent acted on behalf of. The Actor type field, available in the Fields panel, classifies the actor as User, Service account, or Agent. When an older event or a configuration change carries no actor type and names no agent, the field reads Unknown.

Subsystem

The part of Agentic Data Plane that handled the action, such as MCP Gateway, LLM proxy, A2A proxy, Agents, Access control, or Spending. An event from a service that does not declare a subsystem shows Management API (legacy).

Action

The operation the caller invoked, such as tools/call for an MCP tool call or the request path of an LLM call.

Resource name

The name of the affected resource. When one call decided on more than one resource, the cell shows a count, such as Multiple resources (3), and the detail pane lists each resource with its decision.

Outcome

Whether the decision allowed the action, masked part of its content, or denied it. A call that decided on more than one resource and allowed only some of them shows Partial. When an access policy allows a call but a guardrail or data policy then stops it, the outcome shows Denied. When one of them masks content, the outcome shows Masked. When a deciding policy is recorded, hover over the outcome to see it. For a Partial call, the tooltip also shows how many resources the call allowed.

The audit log also records the calls agents make to MCP tools, LLM providers, and other agents, including calls an access policy denied. When an agent’s call bypasses policy evaluation, the event’s status detail reads allowed by internal-caller exemption; no policy evaluated.

An MCP session’s setup and keep-alive calls, such as initialize, tools/list, ping, and notification messages, are recorded only when they fail or are refused, so the log shows the tool calls a session makes rather than every message it exchanges.

Choose columns

The Fields panel lists every audit field in two groups. The Table columns group holds the fields shown as columns, and the More fields group holds the rest. To change the set:

  • Click the eye icon on a field to show it as a column or hide it.

  • Drag a column’s grip to reorder it, or focus the grip and use the arrow keys.

  • Click the reset icon to return to the default columns.

  • Drag the edge of a column header to resize the column, or focus the edge and use the arrow keys.

  • Click Full width to give the table the whole window, and click it again to return.

The browser remembers your column selection. It is not part of the page URL, so a link you share shows the recipient’s columns, not yours.

Fields beyond the default columns include Actor type, Agent, Agent UID, Invoked by, Service, Resource type, Resource ID, Parent, Parent type, Policy, All policies, Policy UID, Status, Status detail, Activity, Event class, Source IP, and Source service. Parent and Parent type name the MCP server behind a tool call or the agent behind a credential.

Activity and Event class come from the event’s OCSF classification. Activity is Create, Read, Update, Delete, or Other, and an invocation such as a tool call reads Other. Event class is API Activity for an authorization decision or Entity Management for a configuration change.

Filter events

The search bar, the Fields panel, and the time range work together. Every filter is part of the page URL, so a narrowed view is shareable.

The search bar reads Search, or filter: field=value to match, field!=value to exclude, and Add another filter… after the first chip. As you type, it suggests fields whose label or key matches, then the chosen field’s most common values with their call counts. Each entry becomes a chip, a removable filter token in the bar:

  • Type a word or phrase and press Enter to match it against the event message. Matching is case-insensitive and applies to the whole history in the time range, not only the rows on screen. The audit log keeps one phrase at a time, so a second phrase replaces the first.

  • Type <field>=<value> to show only events where the field has that value, for example, subsystem=mcp-gateway, actor_type=Agent, or outcome=denied.

  • Type <field>!=<value> to exclude events with that value. An exclusion chip shows the field and value joined by a not-equal sign.

  • Type sort=<field> to reorder the table from the bar, or sort=<field> desc for descending order.

In these filters, <field> is the field’s key, which the suggestion list shows as you type the field’s name, and <value> is a value the field takes, such as one listed in the Fields panel. Some keys differ from the column label, such as operation for Action, deciding_policy for Policy, and operation_status for Status. The outcome key takes allowed, masked, partial, or denied.

Select a suggestion, or finish typing and press Enter. To remove a chip, click its close icon. Clear all removes every chip. A link saved before the search bar replaced the filter controls still opens with the same filters, shown as chips.

Chips on different fields narrow the match, so an event must match all of them. Chips on the same field widen the match. With outcome=denied and outcome=partial, an event matches if it has either value.

Browse values in the Fields panel

To browse instead of typing, expand a field in the Fields panel. It lists the field’s most common values that match the current time range and filters, each with its call count and its share of matching calls. A value with denied calls also shows the denied count. To filter from the list:

  • Click a value to filter to it. Click it again to remove the filter.

  • Click the exclude icon on a value to hide its events instead.

When more values exist than the list shows, it ends with the message More values exist. Add another filter to narrow this list down. To reach a missing value, narrow the list with another filter or type the value in full in the search bar. Activity, Event class, Status, and All policies have no value list and take a typed value.

Set the time range

Click the range control to choose Last 15 minutes, Last hour, Last 24 hours, Last 7 days, Last 30 days, or All time. To review a past window, select Custom range, set the start and end times in UTC, and click Apply.

The timeline shows event volume across the range, with denied events in a separate color, and reports the total count and denied percentage. The percentage counts partial calls as denied. Hover over a bar to see its window and counts. Click a bar to zoom to its window, or drag across the timeline to zoom to a range of bars. Click Zoom out to return, or Hide timeline to collapse it.

For example, to investigate recent MCP authorization failures, type outcome=denied and subsystem=mcp-gateway in the search bar and choose Last hour.

Sort events

Click a column header to order the table by that column, click it again to reverse the sort, and click a third time to return to the default order. The table sorts by Time by default, most recent first, so on that column the second click already restores the default. You can sort every field except All policies, which holds more than one value per event. Outcome orders allowed events first, then masked, partial, and denied events, so a descending sort brings denied events to the top. The order is part of the page URL.

Inspect an event

Select a row to expand it. The expanded row repeats the selected columns for that event, and each filterable value offers filter and exclude actions, so you can narrow the table to that actor or resource in one click. Click Open event details to open the detail pane. The pane stays open and follows the row you select. Changing a filter, the sort, or the time range closes it.

When the information is available, the Event section identifies the actor, outcome, invoking identity, agent, subsystem, service, operation, activity, event class, resource, source IP, emitting service, and tenant. When the event names an agent, an MCP server, an LLM provider, or an access policy, that value links to the entity’s page, and an MCP tool links to its server’s page. A role binding appears as plain text.

The Policies section lists the policies that took part in the decision, in the order they ran:

  • Access: The access policy or role binding, and whether it returned Permit or Deny. An access policy links to its edit page.

  • Guardrail: The guardrail on an LLM call, and whether it returned Blocked or Masked. The guardrail links to its page.

  • Data policy: The data policy on the MCP server behind a tool call, and whether it returned Blocked, Masked, or Passed. The data policy links to the Data Policies tab of its MCP server.

A guardrail appears here only when the AI Gateway evaluated it itself. A guardrail that Bedrock enforces as part of the model call is not attributed in the audit log. See Review blocked requests.

When a guardrail or data policy took part, a note states the combined result, for example, access was granted but the data policy stopped the call.

When a call decided on more than one resource, the pane adds a Resources section that lists each resource and its decision. The list puts denied resources first, so a denied resource stays on the first page however many resources the call touched. For a call that decided on many resources, narrow the list:

  • Exact resource ID: Enter a resource’s full identifier to show only that resource. Matching is case-sensitive.

  • Outcome: When the call’s outcome is Partial, filter the resources by Allowed or Denied. A fully allowed or fully denied call gives every resource the same outcome, so it has no such filter.

Depending on the action, the pane also shows:

  • A Configuration change section with the versions before and after

  • A Request section with the captured request data

  • A Response section with the status, code, error, and captured response data

The page URL carries the open event, so a link you share opens the audit log on that event. If you follow a link from the pane to an agent, an MCP server, an LLM provider, a guardrail, or an access policy, the back arrow on that page returns you to the audit log, to the same rows, scroll position, and open event.

Captured values might be redacted, truncated, or absent. A redacted value reads [REDACTED], and a captured request or response body is cut at 16 KB. An empty field does not mean that no activity occurred. Use the event’s outcome and policy as the primary record of the authorization decision.

Audit log compared to transcripts

Use the audit log for access and accountability questions:

  • Who attempted an action?

  • Which resource and subsystem did it touch?

  • Was the action allowed or denied?

  • Which policy made the decision?

  • Did a guardrail or data policy stop or mask the call?

Use transcripts for execution questions about an agent conversation, including model turns, tool calls, errors, timing, and token usage. An investigation might need both views: start with the audit log to identify an authorization decision, then inspect the related agent activity for execution details.

Troubleshoot the audit log

Issue What to do

Audit log is missing from the sidebar

Either you haven’t selected an Agentic Data Plane environment yet, or your account doesn’t have dataplane_adp_auditlog_list. Select an environment first. If the entry still doesn’t appear, ask an administrator to grant the permission from the Admin role, from a built-in template such as Read only, or from an access policy naming Action::"AuditLog.list".

You opened the audit log by URL and the page reports that it is not available

The page hides the sidebar entry and the route for the same missing permission. Ask an administrator to grant dataplane_adp_auditlog_list.

No events match

Remove the chips with Clear all, then widen the time range. The default view includes only the last 24 hours. If the table stays empty, the deployment might not have audit recording enabled yet. Agentic Data Plane gates page access and recording independently.

The page dropped a filter from a shared link

The page names the filter it dropped and the reason, such as a field that does not exist. Retype the filter in the search bar and pick the field from the suggestion list.

The Fields panel is not visible

In a narrow window, or when the detail pane is open on a mid-sized window, the panel collapses to a strip. Click the panel icon on the strip to expand the panel.

A call shows Denied although the caller has access

Open the event and read the Policies section. When the Access row reads Permit and the Guardrail row of an LLM call or the Data policy row of an MCP tool call reads Blocked, the access policy allowed the call, and the check that ran after it stopped the call. Follow the link in that row to review the guardrail or the server’s data policies.

An event has no request, response, or configuration details

Not every event includes these fields. Use the event’s actor, action, resource, outcome, and time to continue the investigation.

Next steps