Skip to content
Onplana Docs

Review what AI agents did (Agent Activity)

Enterprise planOwner or Admin

The Audit Logs page has two tabs. The main Audit Log tab records human actions (who changed what). The Agent Activity tab is the parallel record for AI: every operation a connected AI agent (Claude, ChatGPT, Cursor, and other MCP clients) or the in-app assistant ran on your organization’s data, whether it succeeded, failed, or was blocked.

What it shows

Section titled “What it shows”

Each row is one agent operation: the tool that ran, its outcome, the acting person, the agent connection it came through, and the entity it touched. The outcome is one of:

  • Applied, the operation ran and changed data.
  • Failed, the operation errored and changed nothing.
  • Gated, the operation was held for review or blocked by a policy (for example, a governed destructive operation that is not enabled).
  • Unauthorized, the agent lacked permission for the operation.
  • Cap exceeded, a rate or budget cap stopped the operation.
  • Undone, the operation was applied and later reversed.

Preview-only operations (an agent proposing a change without applying it) are hidden by default, so the list stays focused on things that actually happened or were actively denied.

Filter and inspect

Section titled “Filter and inspect”
  • Filter by tool to see just one kind of operation (for example, only task updates).
  • Filter by outcome to isolate failures, denials, or undone actions.
  • Search to narrow the list further.
  • Expand any row to see the full operation as copyable JSON: the tool, status, mode, acting user, agent connection, entity, and the input and output payloads. This is the detail you hand to an auditor or paste into a ticket.

Agent Activity vs the Audit Log

Section titled “Agent Activity vs the Audit Log”

They answer different questions and are backed by different records:

Audit Log Agent Activity
Answers What did people change? What did AI agents do?
Records Human and system actions AI operations (successes, failures, denials)
Detail Action, actor, target, time Full operation payload as copyable JSON

Use the Audit Log for governance of people, and Agent Activity to see exactly what your connected agents are doing on your data, and to prove that blocked operations were in fact blocked.

Policy approval decisions

Section titled “Policy approval decisions”

An agent policy rule can hold an agent’s call until a person approves it (the PMO governance and Consulting starter packs in Agent Policies add rules like this). The held call shows here as Gated. The person’s decision is recorded in the main Audit Log: one Agent policy approval decided entry each time someone approves, rejects, or dismisses an approval. An approval nobody decides writes no entry.

Each entry carries:

  • The reviewer: the person who decided, as the entry’s user.
  • The approval: the resource is AgentPolicyApproval, and the resource id is the approval’s id.
  • The details: the decision, the id and label of the rule that asked for the approval, the tool the agent called, the agent provider, and the conversation the call came from.

The decision is one of three:

  • APPROVED, the agent may run that exact call once. When it re-issues the call, the call runs and its outcome shows here.
  • REJECTED, the call stays blocked. When the agent re-issues it, it shows here as Gated.
  • DISMISSED, the approval was closed without an answer. It authorizes nothing: the call stays blocked, and the agent’s next attempt opens a new approval, whose decision gets its own entry.

Where to see them:

  • Audit Log: pick AGENT_POLICY_APPROVAL_DECIDED in the action filter, or AgentPolicyApproval in the resource filter. The filters list what your organization’s entries contain, so the action appears there within a few minutes of the first decision. The action shows in purple, like other policy and permission changes; expand an entry to see its details.
  • Audit export: the CSV and JSON files include these entries with their details. See Read audit logs.
  • Agent tools: an agent connected for an Owner or Admin can read them with list_audit_log, which returns the details, or export_audit_log, which returns the entries without their details.
  • Agent Policies: the Recent policy decisions list at the bottom of Settings → Agents → Agent Policies shows the latest decisions in time order with the rules’ own verdicts. Each decision has an Approved, Rejected, or Dismissed badge and the name of the person who decided. The list holds the 20 most recent rows of both kinds.

Only a signed-in person can decide an approval. API tokens and agent (OAuth) connections are refused, so an agent cannot approve its own call with its person’s token. Deciding also needs the View all org projects permission (Owner, Admin, and Manager by default).

FAQs

Section titled “FAQs”

Does this include the in-app assistant, or only external agents? Both. Any AI operation, whether from a connected MCP client or the in-app assistant, appears here.

Why is an agent action not in the main Audit Log? The main Audit Log and Agent Activity are separate records. Agent operations are tracked in Agent Activity with far more detail (the full input and output). Some agent actions that change core data also leave an Audit Log entry, but Agent Activity is the complete AI record.

Can I see operations that were denied? Yes. That is a key reason the tab exists. Gated, Unauthorized, and Cap-exceeded outcomes are all shown, so you can confirm your agent policies are holding.

Section titled “Related”