Audit and replay
Tamper-evident events capture who ran which bash, path, MCP, or prompt action—under which policy, with what outcome—so audits and retros have a replay you can trust.
Why it matters
Incidents lack evidence when agent actions lived only in a local chat transcript. Relay records allow and deny outcomes across control channels and Behavior Guards so security, platform, and engineering can reconstruct the same timeline.
Real-world incident
Friday 16:40. A staging database password rotated unexpectedly. Slack blamed “someone’s Cursor session.” The engineer’s chat history showed a long debug thread—and then a gap where the IDE had restarted. Local history was incomplete; laptop sleep had truncated the buffer.
Without Relay. The team grepped laptops and cloud audit logs for hours. They could see a Vault API call from a developer IP, but not whether an agent had proposed secrets.rotate, whether a human confirmed Soft ask, or which Rulebook rule (if any) should have blocked it. The retro ended in “we think an MCP tool ran”—no rule id, no session id, no deny reason.
With Relay. Live wire for that org showed the sequence in order:
- Path deny on
.env.staging(rule matchedcontains .env) - Prompt deny when a pasted secret marker hit prompt control
- MCP allow on a read-only catalog tool, then MCP deny on
secrets.rotate(exact tool id) - Minutes later, Soft ask on a related shell—engineer dismissed—then deny after Enforcement was tightened
Same seat, same session id, timestamps aligned with the Vault event window. The retro closed with a concrete fix: tighten the MCP allowlist and add a Behavior Guards Privilege Streak threshold—not a vague “be careful with agents” note.
That is the job of audit and replay: turn “the agent might have done it” into a shared, policy-linked event trail.
What gets recorded
- Requester / seat (and surface: Cursor, Claude, Codex, OpenCode when stamped)
- Control channel (bash, path, MCP, prompt) and Behavior Guard fields when a pattern detector fires
- Action requested (command / path / MCP tool / prompt preview—truncated, not full secret bodies)
- Policy rule or builtin that matched (or default allow)
- Allow / ask / deny (and Behavior Guard stage when relevant)
- Session id for Session Trace-style timelines in Live wire
- Timestamp
Where to look in Console
| Surface | Use when |
|---|---|
| Live wire | Near-real-time decisions; filter by user, surface, kind, behavior |
| Pulse | Aggregates—volume, denies, open Behavior Guard incidents |
| Guards | Open pattern incidents + Acknowledge (clears detector streaks) |
| Rulebook | Which rules produced hits—edit after a retro |
Retention
Audit log retention follows your Relay / Full Platform plan. See published limits on exemplar.dev/pricing —do not assume longer retention than your plan includes.
Connect hooks under Relay → Connect (Connect surfaces) so Claude, Cursor, Codex, and OpenCode sessions emit events. Related: Bash · Path · MCP · Prompt · Behavior Guards · Seats and policy.