tenant demo-internal

Audit trail

append-only · 40,221 rows · payloads redacted at write

Invocations

Most recent tool invocations, newest first
Time	Decision	Subject	Tool	Reason	ms
14:02:11.482	deny	analyst@demo	ticket.create	scope write:support missing	3.1
14:02:10.907	allow	support@demo	ticket.update_status	grant support/ticket.update_status	41.8
14:02:10.114	allow	analyst@demo	invoice.search	grant analyst/invoice.search	22.4
14:02:08.660	allow	finance@demo	invoice.summary	grant finance/invoice.summary	18.0
14:02:07.031	deny	unknown	customer.lookup	401 token expired	0.9
14:02:05.772	allow	support@demo	customer.lookup	grant support/customer.lookup	12.6

Row 40,221

deny

subject: analyst@demo
role: analyst
tool: ticket.create
token scope: read:customers read:billing
decision: scope ∧ grant = false

Arguments, as stored

{
  "customer_id": "C-10442",
  "subject": "Refund request",
  "body": "[redacted]",
  "contact_email": "[redacted]",
  "upstream_key": "[redacted]"
}

Redaction happens before the row is written. The raw values are never stored.

Grants

Changes send notifications/tools/list_changed to live sessions

Role to tool grants matrix
Tool	analyst	support	finance	admin
customer.lookup
invoice.search
ticket.create
ticket.update_status
invoice.summary