Decisions Log

Every gateway call produces a Decision row: who called what, when, and the verdict.

Identity Chain — click any decision row to see the full chain: IdP → user role → AI actor → MCP server → tool → target → policy → decision. One screen of audit evidence.

Trace replay — re-evaluate any historical decision against current policies to see what would happen now. Useful for "did this break when I changed the policy?" investigations.