Overview

Activity & conversations

Activity is the audit trail: one row per AI request, recorded by the Gateway after the response streams back.

What's recorded

Model, tool (Claude Code / Cursor / …), developer identity, device, connection mode (subscription pass-through vs managed key), outcome (ok / blocked / upstream error), token counts, latency, MCP servers declared — and any risk findings embedded on the row (detector, action taken, severity). Request and response content is never stored by default.

Prompt capture (opt-in)

If your organization enables prompt capture, transcripts are stored redacted — secrets and personal data are replaced with [REDACTED:kind] markers before anything is written. Capture is off by default, and audit rows deep-link to the captured conversation when it exists.

Blocked conversations

When the AI classifier issues a blocking verdict, the whole conversation is flagged: subsequent requests are rejected until an admin clears the block from the Policy page. This turns a finding into an enforced stop, not just a log line.

Compliance evidence

The Compliance screen exports an evidence pack (policies in force, detector actions, activity summaries) for auditors — see the Compliance & SIEM guide.