Audit AI tool usage

What C1 logs for AI tool calls, MCP resource reads, and AI system events, and where to find audit export options.

Activation required. AI access management must be enabled for your tenant before you can use it. To get started, contact the C1 support team for a walkthrough.

Every tool call and resource read that flows through C1 MCP is logged. This page covers what’s captured and how to export it for long-term retention, SIEM ingestion, or compliance reviews.

What gets logged

Each tool call produces one audit log entry with:

Field	Example
Timestamp	2026-05-07T14:23:11Z
End user	The C1 user the AI client is bound to
AI client	Client ID and display name
MCP server	Registered server name
Tool	Tool name (for example, github_create_issue)
Result	Success / denied / error
Denial reason	Populated when result = denied (for example, “tool not in user’s access profile”, “kill switch active”, “client closed”)
Latency	Round-trip time for the call

Each MCP resource read also produces an audit log entry. It includes the end user, AI client, MCP server, resource URI or URI template, result, denial reason when applicable, latency, and response byte count. C1 does not store resource content in the audit event.

In addition to tool call events, the following non-call events are also captured:

• Access request submitted / approved / denied
• Tool approved / disabled / classification changed
• MCP server registered / removed / auth changed
• AI client registered / state changed (active → hidden → closed → deleted)
• Kill switch flipped (tenant, server, tool, or client level)
• Tenant defaults changed

Review AI agent conversations

The Conversations page under AI gives admins a read-only view of AI agent conversations across your organization. Conversations are organized into Web, Slack, and System tabs so you can review activity from all three surfaces in one place.

To access it, navigate to AI > Conversations. On the Slack tab, use the search bar to find conversations by title, then click any conversation to open a read-only transcript.

System tab: agent policy step evaluations

When an approval policy step is assigned to an agent, each evaluation is attributed to the built-in C1 System agent identity and logged in the audit log as an AI-agent action. The evaluation is also recorded as a conversation under the System tab, so you can review the agent’s reasoning and tool calls behind any policy decision. See Assign for review to configure an Agent step.

Export the audit log

AI tool usage events are included in the C1 system log. To set up export to S3 or another data source for SIEM ingestion, see System logs.