Agentic Data Plane
Preview

Review the Audit Log

The audit log records authorization decisions across Agentic Data Plane. Use it to answer who performed an action, which resource they acted on, where the request came from, and whether the request was allowed or denied.

After reading this page, you will be able to:

  • Filter authorization events by time, outcome, subsystem, or search term

  • Inspect the actor, action, resource, source, and policy behind an authorization decision

  • Choose the audit log or a transcript for an investigation

The audit log is a preview capability. Access to the page is granted per organization, and audit recording is enabled per deployment; the two are independent. If you don’t see Audit Log in the sidebar, it isn’t enabled for your organization.

A deployment can therefore show the page with no recorded events. If the table is empty for a period you know had activity, see Troubleshooting.

Prerequisites

Your account needs the dataplane_adp_auditlog_list permission to open the audit log and view event details. Outside the Admin role, audit log reads come from an access policy naming Action::"AuditLog.list". See Audit log permissions.

Audit events can include user identities, resource names, network information, configuration changes, and captured request or response data. Grant audit log access only to people who need it, and review events before sharing them.

Open the audit log

  1. Open Audit Log in the sidebar.

  2. Review the most recent events. The default time range is Last 24 hours.

  3. Select a row to open its details.

The table shows these fields:

Field Description

Actor

The user accountable for the action. When an agent or another identity acted for the user, the table also identifies that caller when available.

Subsystem

The part of Agentic Data Plane that handled the action.

Action

The operation and service involved.

Resource

The type and identifier of the affected resource. When one call decided on more than one resource, this shows a count, such as 3 resources, and the detail panel lists each resource with its own decision.

Outcome

Whether the authorization decision allowed the action, denied it, or, for a call that decided on more than one resource, allowed some resources and denied others (Partial). Hover over the outcome to see the deciding policy when available.

Time

When the decision occurred.

Filter events

Use the controls above the table to narrow an investigation:

  • Search: Match a keyword against the event messages.

  • Actor: Enter an exact actor identity, such as an email address, to show only that actor’s events.

  • Resource type: Enter a full namespaced resource type, such as redpanda.agent, to show events for that type. Matching ignores case. The table’s Resource column shows the type without its namespace prefix, so redpanda.agent appears as agent.

  • Resource ID: Enter an exact resource identifier to show events for a single resource. Matching is case-sensitive.

  • Outcome: Show allowed actions, denied actions, or partial outcomes. Select more than one to combine them.

  • Subsystem: Select one or more of Management API, LLM proxy, MCP gateway, A2A proxy, and Spending.

  • Time range: Choose a duration of Last hour, Last 24 hours, Last 7 days, Last 30 days, or All time. To review a past window, set an end time, and the duration counts back from that time instead of from now.

Filters work together. For example, select Denied, choose MCP gateway, and set Last hour to investigate recent MCP authorization failures.

Inspect an event

Select an event to open its detail panel. The panel identifies the actor, outcome, subsystem, operation, resource, deciding policy, source, and time when that information is available.

When a call decided on more than one resource, the panel opens with a Resources section that lists each resource and its own decision. Select a resource to see its individual outcome and deciding policy in the panel.

For a call that decided on many resources, narrow the Resources section with the controls above the list:

  • Exact resource ID: Enter a resource’s full identifier to jump to it. Matching is case-sensitive.

  • Outcome: When the call’s outcome is Partial, filter the resources by Allowed or Denied to separate the denied resources from the allowed ones. This filter appears only for a Partial call, because a fully allowed or fully denied call gives every resource the same outcome.

The list is paged and has a selectable page size, so a decision that covered dozens of resources stays quick to scan.

Depending on the action, the panel may also show:

  • The agent or caller that acted for a user

  • The event class and activity

  • A configuration change with before and after values

  • Captured request data

  • Response status, error, or captured response data

Captured values may be redacted, truncated, or absent. An empty field does not mean that no activity occurred. Use the event summary and outcome as the primary record of the authorization decision.

Audit log compared to transcripts

Use the audit log for access and accountability questions:

  • Who attempted an action?

  • Which resource and subsystem were involved?

  • Was the action allowed or denied?

  • Which policy made the decision?

Use transcripts for execution questions about an agent conversation, including model turns, tool calls, errors, timing, and token usage. An investigation may need both views: start with the audit log to identify an authorization decision, then inspect the related agent activity when you need execution details.

Troubleshoot the audit log

Issue What to do

Audit Log is missing from the sidebar

The preview may not be enabled for your organization. Contact your Redpanda representative.

You cannot open the audit log

Ask an administrator to confirm that your account has dataplane_adp_auditlog_list, from the Admin role or from an access policy naming Action::"AuditLog.list".

No events match

Clear the search and filters, then widen the time range. The default view includes only the last 24 hours. If the table stays empty, audit recording may not be enabled for this deployment yet; page access and recording are gated independently.

An event has no request, response, or configuration details

Not every event includes these fields. Use the event’s actor, action, resource, outcome, and time to continue the investigation.

Next steps