Product
Audit log
Every agent run, event, session and control action is appended to a hash-chained log you can verify.
Hash-chained
Each record carries the hash of the one before it.
Read it
$ smx agent runs
$ smx agent logs <run-id> -f
Denials are recorded
Refused actions arrive as policy.denied events. The file gateway records every refused write or access to denials.jsonl; refused network destinations come from the egress rules.
Redaction
Secrets are redacted from the agent log; see Credentials.
Related
Policies decide what is allowed; the Security model covers the full design.
Related: Policies · Security model · Install