Audit tools

The audit trail: what happened, who did it, and what was refused.

Permission is what the tool server requires before it dispatches; who holds it is read from the control plane’s own grant. The two are read from different places on purpose: a tool server that grants more than the control plane does offers an operation and then has it refused halfway through a conversation.

Advertised says whether the tool appears in the default tool list. Most do not: a small window is advertised and the rest are found with search_tools, read with describe_tool and invoked with request_tool. A tool reached that way is checked against the same permission as a direct call.

Generated from Tool. Hand edits to this table are overwritten on the next build — change the Go doc comment, or the generator.

Tool	Permission	Who holds it	Advertised
audit_errors	audit:read	an administrator only, through the wildcard grant	no
audit_query	audit:read	an administrator only, through the wildcard grant	no
audit_stats	audit:read	an administrator only, through the wildcard grant	no

audit_errors

Find recent errors and failures in the audit log. A convenience wrapper around audit_query that filters for failed operations. Useful for troubleshooting issues. Use format=‘summary’ (default) for minimal output, ‘standard’ for operational details, or ‘full’ for complete data.

Argument	Type	Required	Meaning
deploymentName	string	no	Filter by deployment name
since	string	no	How far back to look (e.g., ‘1h’, ‘24h’, ‘7d’). Default: ‘24h’
limit	integer	no	Maximum number of errors to return (default: 20)
format	one of summary, standard, full	no	Response detail level: ‘summary’ (minimal), ‘standard’ (operational), ‘full’ (complete). Default: summary

audit_query

Query audit logs to investigate what actions have been performed. Useful for troubleshooting issues, security analysis, and understanding system activity. Supports filtering by source, actor, action type, resource, deployment, and time range. Use format=‘summary’ (default) for minimal output, ‘standard’ for operational details, or ‘full’ for complete data.

Argument	Type	Required	Meaning
source	one of odysseus, athena	no	Filter by event source (odysseus for control plane, athena for AI assistant)
actor	string	no	Filter by actor/user who performed the action
type	string	no	Filter by event type category (e.g., ‘deployment’, ‘container’, ‘network’, ‘volume’)
action	string	no	Filter by specific action (e.g., ‘create’, ‘delete’, ‘scale’, ‘restart’)
resource	string	no	Filter by resource name or ID
resourceType	string	no	Filter by resource type (e.g., ‘deployment’, ‘container’, ‘network’, ‘volume’)
deploymentName	string	no	Filter by deployment name
status	one of success, failure, error	no	Filter by outcome status
since	string	no	Show events after this time (RFC3339 format, e.g., ‘2026-01-14T00:00:00Z’ or duration like ‘1h’, ‘30m’)
until	string	no	Show events before this time (RFC3339 format)
limit	integer	no	Maximum number of entries to return (default: 50, max: 500)
format	one of summary, standard, full	no	Response detail level: ‘summary’ (minimal), ‘standard’ (operational), ‘full’ (complete). Default: summary

audit_stats

Get statistics about audit log entries. Shows breakdown by event type, outcome, actor, and source. Useful for understanding overall system activity and identifying patterns.

Argument	Type	Required	Meaning
since	string	no	Start of time range (RFC3339 format or duration like ‘24h’, ‘7d’)
until	string	no	End of time range (RFC3339 format)