Search the audit trail

Find the decision behind a specific governed request.

Before you start

Collect the approximate time, environment, actor or agent, tool, and correlation identifier when available.

Procedure

1. Open audit search and constrain the time range and environment.

2. Filter by the actor, agent, resource, or correlation value from the request.

3. Read the outcome, reason, policy version, credential mode, and projection context available in the event.

4. Compare the event with the configuration that was active at that time, then make the smallest correction at the failing boundary.

Verify the result

Rerun the same test after the correction and compare the new decision. Keep the evidence limited to identifiers and decision metadata.

If it does not work

If there is no event, verify the time window and scope, then check runtime audit delivery. Absence from a query does not establish that no request occurred.

Read the related concept or consult the Admin API for exact request fields.

Implementation reference

Read the source contract.