> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rubric-app.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> Every governed tool call, filterable, with traces.

The Audit log is the canonical record of everything Rubric records: every `evaluate()` call your fleet has made **plus** every operator action that touched governed state (policy scope edits, manual incident opens, agent freezes). One unified ledger, one hash chain, one place to answer *"what happened in this org?"* with cryptographic certainty.

## Tool calls vs config events

Every row is either a **tool call** (an `evaluate()` from the SDK) or a **config event** (an operator action like editing scope, opening an incident, or freezing an agent). They're rendered differently:

| Family       | Origin                           | Decision pill            | Click row                                |
| ------------ | -------------------------------- | ------------------------ | ---------------------------------------- |
| Tool call    | SDK `evaluate()`                 | `allow` or the deny code | Opens the trace drawer.                  |
| Config event | Operator action in the dashboard | `config` (orange)        | No drawer — config events have no trace. |

All rows are written to the same tamper-evident chain, so any tampering with a config row is as detectable as tampering with a decision row. The chain-integrity card on this page covers both kinds.

## The list

Columns:

* **#seq** — the row's position in the tamper-evident chain.
* **Time** — when the event happened (your local timezone).
* **Agent** — the agent's stable id. For config rows, this is the agent the operator acted on.
* **Tool / Action** — the tool name for tool-call rows, or a human-readable action label for config rows (e.g. "Added agent to policy scope").
* **Decision** — `allow` (green), the deny code (red), or `config` (orange) for non-decision rows.
* **Latency** — for tool calls only; config rows show `—`.
* **Session** — first 8 chars of the session id for tool calls; `—` for config rows.
* **📄** — orange file icon if a trace is attached (tool calls only).

## Filters

* **Decision tabs** — `All`, `Allow`, `Deny`. Click to filter.
* **Search** — case-insensitive substring match across `toolName`, `sessionId`, and `agentId`. Press Enter or blur to apply. Click `clear` to reset.

## Pagination

Cursor-based on `(timestamp desc, id desc)` so concurrent ingest doesn't skip rows. Click **Load more** for the next page. The current page size is 50.

## Click a row → trace drawer

Click any row to open the trace drawer on the right. You'll see:

* **The full transcript** — user messages, assistant replies, tool calls and results, in order.
* **The current call highlighted** — the message that this audit row was emitted for is marked.
* **DLP highlights inline** — secret/PII matches are flagged in the message body.

If the row has no trace (the icon column is empty), the drawer shows a friendly empty state explaining how to attach traces by passing a `TraceContext` to `evaluate()`.

## Performance

Filtering by time, tool name, decision, or any combination is fast even at millions of rows. If you have a filter combination that feels slow (e.g., by `sessionId` or by `policyId`), file an issue and we'll tune the index.

## Export

The export button (top-right) is a placeholder in the current build. CSV export is coming soon — for now, use the in-page filters and copy.