Audit log
The audit log is the record: every decision from every agent in the organisation, in one place, in the order it happened.
What each event carries
| Field | Meaning |
|---|---|
| Time | When the agent asked. |
| User and Agent | Who was running the agent, on which machine. |
| Command | The shell command or MCP tool call, with a one-line explanation of why the rule cares. |
| Decision | BLOCK, AUDIT, ALLOW, or would-have-blocked when the organisation is in audit-only mode. |
| Rule | The rule id that fired, linked to its taxonomy node and controls. |
| Source | Which hook produced the event: claude-code-hook, claude-code-mcp-hook, cursor, shell, and so on. |
Filtering and export
Filter by decision, member, date range, or free text over commands and related rule/tool fields. Investigations from AI Insights also preserve agent, MCP server, source, rule, taxonomy, session, exact event, weekday, hour, and outcome filters. The result count and pagination refer to matching events. Remove individual filter chips to widen an investigation.
Export CSV exports the current filtered result across its pages. AI Insights uses UTC for daily and weekday/hour investigations, and a date-only end date includes the full UTC day.
Integrity
Events are hash-chained: each event carries the hash of the one before it, so a gap or an edit is detectable. The chain is verified when evidence is exported.
Retention
Free organisations keep 7 days, Team 90 days, Enterprise one year. Local installs keep their own ~/.agentshield/audit.jsonl regardless.
Abnormal activity
Beyond individual rules, the platform surfaces allowed but abnormal behaviour: for example an agent that reads a customer export and then, for the first time in 30 days, uses curl. These findings are advisory, explain the signals behind them, and can be turned into a rule or added to compliance evidence from the finding itself. This surface is in preview; see the showcase.