Audit Log
The Audit Log is Cakewalk's immutable record of every tool call. Audit events are how Admins investigate what an Agent did and why.
Last updated
Was this helpful?
The Audit Log is Cakewalk's immutable record of every tool call. Audit events are how Admins investigate what an Agent did and why.
The Audit Log is the structured, immutable record of every tool call passing through the MCP Gateway. The gateway writes one audit event per tool call. Audit events are the investigation surface for any Admin question that starts with "why did the Agent do that?"
Audit Log: Cakewalk's immutable record of every tool call. The MCP Gateway writes one audit event per call.
Audit event: A single tool call's record: who, what, against which Connection, which Policies fired, what data was exchanged.
Triggered Policy: Any Policy whose conditions matched the tool call. Multiple Policies can trigger on a single call. The gateway applies one outcome per call, resolved by the Policy conflict rules (Custom > Default, then most restrictive wins).
💡 Why this matters: The Audit Log is the only way to answer "why was this allowed?" or "why was this blocked?" Audit events are immutable: each event is what the gateway decided at the moment of the call.
Each audit event records:
The request payload sent to the Connection
The response payload returned to the Agent
Every triggered Policy with its conditions and outcome
The event surfaces alongside the tool call's context: User, Agent, Connection, tool, Action type, decision (Auto-approved, Require approval or Denied) and timestamp.
The Admin sees the full record in a single side panel and reviews exactly what data was shared through the gateway.
Audit events surface in three places in the Admin product surface:
Agent Activity: The org-wide reverse-chronological view of every session across the org. Click any tool call row to open the audit event.
Sessions tabs: Filtered views of the same data, scoped to one Agent, one Connection or one User. Same nested table pattern (session row, expand, tool call rows, click for the event).
Tool call side panel: The drawer that opens when an Admin clicks a tool call. Shows request payload, response payload and every triggered Policy with its outcome.
Once written, an audit event cannot be modified. The record stays accurate even as the surrounding state changes:
If a Policy changes after the call, the event still shows the Policy that fired at the time.
If a User is offboarded, the event still shows what they delegated.
If an Agent is restricted, the event still shows everything the Agent did before.
The MCP Gateway: where audit events are produced
The Tool Call Lifecycle: Step 6 produces the audit event
Policies: what makes a Policy trigger and how conflicts resolve
Trust and Security: what payload data the gateway sees and stores
Last updated
Was this helpful?
Was this helpful?