The journal

Every call your agent makes is recorded, with what the policy decided and why. The journal is kept where the studio is: in your browser on the site, in the workspace's journal/ on your machine.

A record

One record a call, when the call has ended:

• the action: the service, the operation, who called it, and its arguments, with secrets masked;
• the policy: its name and the hash of its text. The text itself is kept beside the journal, so a record can be read against the policy that decided it;
• the decision and why: - by a rule: the rule and the values it met (amount = 30000), and the rules tried before it; - by default: the default, and why each rule did not apply; - by the policy language: its reasons, the facts it used and the certificate of the theorem;
• a person's verdict: approved, refused or timed out; how long it took; the arguments if changed;
• the outcome: what the service answered, and how long it took;
• the webhooks it was sent to.

Each record carries the hash of the one before. A record changed or taken out breaks the chain, and the check says where.

In the studio

Log shows every message as it went. Its journal section has:

• Download (JSON lines): one record a line, for scripts and jq;
• Download (CSV): a row a call, for a spreadsheet;
• Check the chain: is the journal whole?

Tests → Replay the journal decides every recorded call again by the policy as it is now.

On your machine

The journal is ~/.okay-guard/journal/<day>.jsonl, a file a day; the policies' texts are in journal/policies/. --keep 90 removes the days older than 90.

okay-guard journal --since 7d                       # the records, a line each
okay-guard journal --decision block --agent shop    # only some
okay-guard journal --csv > journal.csv              # for a spreadsheet; --json for scripts
okay-guard journal --verify                         # the chain whole, every policy found
okay-guard journal replay --policy new.policy       # what the new policy would change; exit 1 if anything

Webhooks

A policy may send a call's record to a webhook: on a rule (notify security), or on an outcome (notify ops on refused create_refund). See webhooks. The record is sent as JSON, with a text line on top that a Slack channel shows as it is.