# Overview

# Activity & conversations

**Activity** is the audit trail: one row per AI request, recorded by the Gateway after the response streams back.

## What's recorded

Model, tool (Claude Code / Cursor / …), developer identity, device, connection mode (subscription pass-through vs managed key), outcome (ok / blocked / upstream error), token counts, latency, MCP servers declared — and any **risk findings** embedded on the row (detector, action taken, severity). Request and response **content is never stored** by default.

## Prompt capture (opt-in)

If your organization enables prompt capture, transcripts are stored **redacted** — secrets and personal data are replaced with `[REDACTED:kind]` markers before anything is written. Capture is off by default, and audit rows deep-link to the captured conversation when it exists.

## Blocked conversations

When the AI classifier issues a blocking verdict, the whole conversation is flagged: subsequent requests are rejected until an admin clears the block from the Policy page. This turns a finding into an enforced stop, not just a log line.

## Compliance evidence

The Compliance screen exports an evidence pack (policies in force, detector actions, activity summaries) for auditors — see the Compliance & SIEM guide.