> For the complete documentation index, see [llms.txt](https://www.cakewalk.security/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.cakewalk.security/docs/ai-agent-access/concepts/audit-log.md). # The Tool Call Record Every tool call the MCP Gateway handles leaves a record: who, what, which Policies fired and what was exchanged. This is how Admins answer "why did the Agent do that?" Every tool call passing through the MCP Gateway leaves a structured record. The record is the investigation surface for any Admin question that starts with "why did the Agent do that?" Cakewalk does not present this as a separate log you open. The records surface inside the views you already use: Agent Activity, the Sessions tabs and the tool call side panel. *** ### 📖 Key Concepts * **Session**: One connection between an Agent and the Gateway. A session holds the tool calls made during it. * **Tool call**: A single action an Agent attempted against a Connection. Each one is recorded with its own outcome. * **Triggered Policy**: Any Policy whose conditions matched the tool call. Multiple Policies can trigger on a single call. The Gateway applies one outcome per call, resolved by the [Policy](/docs/ai-agent-access/concepts/policies.md) conflict rules (Custom > Default, then most restrictive wins). :bulb: *Why this matters:* The record is the only way to answer "why was this allowed?" or "why was this blocked?" It captures what the Gateway decided at the moment of the call, not what the rules say today. *** ### 📋 What a Tool Call Record Contains Each record holds: * The **tool** called, its **Action type** and the **Connection** it ran against * The **User** whose access the Agent inherited * Every **triggered Policy**, with its conditions and outcome * The **outcome**: Auto-approve, Require approval or Deny * Where approval was required, **what the person decided** * The **request payload** sent to the Connection and the **response payload** returned * The **timestamp** *** ### 🔍 Where Admins Read It Records surface in three places: * **Agent Activity**: the org-wide reverse chronological view of every session. Click any tool call row to open its record. * **Sessions tabs**: the same data scoped to one Agent, one Connection or one User. Same pattern of session row, expand, tool call rows, click through. * **Tool call side panel**: the drawer that opens on a tool call. Shows the payloads and every triggered Policy with its outcome. *** ### 🛡️ Records Do Not Change A record is what the Gateway decided at the time, and later changes do not rewrite it. * If a Policy changes after the call, the record still shows the Policy that fired. * If a User is offboarded, the record still shows what they delegated. * If an Agent is restricted, the record still shows everything it did before. *** ### Related Concepts * [The MCP Gateway](/docs/ai-agent-access/concepts/the-mcp-gateway.md): where records are produced * [The Tool Call Lifecycle](/docs/ai-agent-access/concepts/the-tool-call-lifecycle.md): Step 6 produces the record * [Policies](/docs/ai-agent-access/concepts/policies.md): what makes a Policy trigger and how conflicts resolve * [Trust and Security](/docs/ai-agent-access/concepts/trust-and-security.md): what payload data the Gateway sees and stores --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://www.cakewalk.security/docs/ai-agent-access/concepts/audit-log.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.