Audit event taxonomy
The audit stream is a stable, machine-readable record of security-relevant decisions and observations. This page is generated from the same registry used by production emitters, so the documented vocabulary and value domains cannot drift from the binary.
Each event is emitted by one plane and component and is stored in the listed physical record class. Evidence tiers describe the durability contract: authority records prove a gated effect, completion records report a resulting artifact, and telemetry records provide operational context.
Event catalog
gateway.egress
Meaning: The enclave gateway observed and mediated an agent egress flow.
- Plane:
enclave - Component:
gateway - Record class:
network_flow - Evidence tiers:
authority,completion - Outcomes:
allow,deny,error
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
proto | tcp|udp | false |
identified | boolean | false |
enclave_name | display name | true |
src | source address | true |
agent_name | agent display name | true |
security_id | Cilium security identity | true |
namespace | agent namespace | true |
agent_id | opaque agent id | true |
group_id | opaque group id | true |
dst_ip | IP address | true |
dst_port | 1..65535 | true |
mediation | mitm|mitm-inject|mitm-agent-token|mitm-capture|llm-route|splice|assert-identity|quic-mitm | true |
sni | hostname | true |
host | hostname | true |
authority | HTTP authority | true |
method | HTTP method | true |
path | request path | true |
status | HTTP status | true |
provider | registered provider | true |
format | inference wire format | true |
upstream | resolved upstream | true |
spiffe_id | SPIFFE identity | true |
injected_cred | credential name only | true |
headers | bounded availability note | true |
deny_floor | boolean | true |
policy_scope | policy scope | true |
policy_reason | stable policy reason | true |
policy_rule | matched rule | true |
trace_id | correlation/AAD id | true |
imds.request
Meaning: An IMDS connection or request could not be attributed to a registered agent and was refused.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
deny
Attrs: none
imds.token.issue
Meaning: An agent received a short-lived identity token.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
expires_in | seconds | false |
imds.credentials.read
Meaning: An agent received its resolved credentials.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
count | non-negative integer | false |
names | credential names only | false |
imds.ca.read
Meaning: An agent read the public gateway CA bundle or the service refused a private-key bundle.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
authority,telemetry - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
imds.context.read
Meaning: An agent read the descriptive run-context document.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
imds.config.read
Meaning: An agent received resolved configuration, potentially including a sovereign secret.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
keys | non-negative integer | true |
key | configuration key | true |
enclave.grant.create
Meaning: An org principal authored an enclave-local grant.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
role | role name | true |
capability | registered capability | true |
group | group id | true |
scope_kind | org|group | false |
reason | correction reason | true |
enclave.grant.revoke
Meaning: An org principal revoked an enclave-local grant.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
principal | principal id | false |
role | role name | true |
capability | registered capability | true |
group | group id | true |
scope_kind | org|group | false |
reason | correction reason | true |
members:read.deny
Meaning: A caller failed the enclave-local member-read capability check.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
deny
| Attr | Domain | Optional |
|---|---|---|
capability | members:read | false |
members:manage.deny
Meaning: A caller failed the enclave-local member-management capability check.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
deny
| Attr | Domain | Optional |
|---|---|---|
capability | members:manage | false |
llmproxy.ingress
Meaning: The LLM satellite accepted or rejected a connection after verifying the agent SVID.
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
authority,telemetry - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | true |
remote | network address | false |
agent_id | opaque agent id | true |
tier | attestation tier | true |
group_id | opaque group id | true |
llmproxy.forward
Meaning: The LLM satellite decided whether a classified inference request could be forwarded.
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
authority,telemetry - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | true |
agent_id | opaque agent id | true |
tier | attestation tier | true |
group_id | opaque group id | true |
spiffe_id | SPIFFE identity | true |
format | inference wire format | false |
provider | registered provider | false |
method | HTTP method | false |
path | request path | false |
upstream | resolved upstream | true |
cred_mode | passthrough|inject | true |
model | model name | true |
attested_upstream | gateway-attested destination | true |
attested_sni | gateway-attested SNI | true |
routing | unattested | true |
severity | policy severity | true |
deny_reason | policy reason | true |
llmproxy.inspection.verdict
Meaning: The LLM satellite’s response-inspection pipeline recorded a verdict for a governed inference response (whole response buffered pre-forward; docs/audit-evidence-tiers.md J2: allow/redact rows are telemetry, reject/deny rows are authority).
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
authority,telemetry - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | true |
agent_id | opaque agent id | true |
tier | attestation tier | true |
group_id | opaque group id | true |
spiffe_id | SPIFFE identity | true |
format | inference wire format | false |
provider | registered provider | false |
model | model name | true |
verdict | composed inspection verdict: allow|reject|redact|escalate | false |
tools | comma-joined detected tool names (names only, never arguments) | true |
inspectors | comma-joined inspector names that ran | true |
llmproxy.escalation.register
Meaning: The LLM satellite registered an escalated inference response for approval (the hold the operator sees).
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | true |
agent_id | opaque agent id | true |
tier | attestation tier | true |
group_id | opaque group id | true |
spiffe_id | SPIFFE identity | true |
format | inference wire format | false |
provider | registered provider | false |
model | model name | true |
summary | operator-facing escalation summary (policy-authored, no tool arguments) | true |
llmproxy.escalation.decision
Meaning: An escalated inference response reached a terminal outcome (approved, denied, or timed out); a timed-out or unreachable backend is the fail-closed deny. One event per escalation.
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | true |
agent_id | opaque agent id | true |
tier | attestation tier | true |
group_id | opaque group id | true |
spiffe_id | SPIFFE identity | true |
format | inference wire format | false |
provider | registered provider | false |
model | model name | true |
summary | operator-facing escalation summary (policy-authored, no tool arguments) | true |
broker.approval.register
Meaning: An enclave satellite (llmproxy) registered a pending tool-call approval with the broker: the hold an operator sees and resolves.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
approval_id | broker-minted approval id | false |
agent_id | opaque agent id | false |
group_id | opaque group id | true |
tool_name | requested tool name (a name, never tool arguments) | false |
broker.approval.decide
Meaning: An operator decided a pending tool-call approval (approve or deny): authority acted on a held response carrying sovereign tool-call content.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny,error
| Attr | Domain | Optional |
|---|---|---|
approval_id | broker-minted approval id | false |
decided_by | authenticated operator principal | false |
agent_id | opaque agent id | true |
tool_name | requested tool name (a name, never tool arguments) | true |
reason | correction reason (error outcome only) | true |
broker.approval.expire
Meaning: The broker marked a pending tool-call approval expired past its deadline (timeout = deny, fail-closed).
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
deny
| Attr | Domain | Optional |
|---|---|---|
approval_id | broker-minted approval id | false |
agent_id | opaque agent id | true |
tool_name | requested tool name (a name, never tool arguments) | true |
tunnel.session.open
Meaning: The relay opened an operator-to-agent interactive session.
- Plane:
enclave - Component:
relay - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
session | opaque session id | false |
enclave_peer | peer actor | true |
tunnel.session.close
Meaning: The relay closed an operator-to-agent interactive session.
- Plane:
enclave - Component:
relay - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
session | opaque session id | false |
enclave_peer | peer actor | true |
bytes | non-negative integer | false |
materializer.agent.provision
Meaning: The materializer created an attested agent’s IMDS socket and runtime mapping.
- Plane:
enclave - Component:
materializer - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
socket | node-local path | false |
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
tee_type | TEE type | false |
measurement | measurement digest | false |
materializer.agent.attest
Meaning: The Plane-3 attestation gate accepted or rejected an agent report.
- Plane:
enclave - Component:
materializer - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
reason | attestation reason | true |
tee_type | TEE type | true |
measurement | measurement digest | true |
assurance | hardware|reduced-sample | true |
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
materializer.agent.svid.rotate
Meaning: The materializer refreshed an agent’s attestation-bound SVID.
- Plane:
enclave - Component:
materializer - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
enclave_id | opaque enclave coordinate | false |
enclave_name | display name | false |
tee_type | TEE type | false |
not_after | RFC3339 timestamp | false |
materializer.agent.deprovision
Meaning: The materializer removed an agent’s socket, mapping, and held SVID.
- Plane:
enclave - Component:
materializer - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
Attrs: none
ssh.cert.mint
Meaning: An operator received a short-lived SSH certificate/session ticket for an agent.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
Attrs: none
exec.open
Meaning: An operator opened an interactive exec session into an agent.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
Attrs: none
tunnel.ticket.mint
Meaning: An operator received a short-lived operator-to-agent tunnel ticket.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
Attrs: none
audit.read.cross_org
Meaning: A platform principal read another org’s controlplane audit and the target org was notified.
- Plane:
controlplane - Component:
auditapi - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
home_org | opaque org id | false |
records | non-negative integer | false |
agenttoken.mint
Meaning: The controlplane refused or issued an agent-operator bearer token.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
enclave | opaque enclave id | true |
tier | attestation tier | true |
agent | opaque agent id | true |
agent.contain
Meaning: An operator CONTAINED an agent (froze it in place: every egress + LLM inference denied, agent-operator authority revoked; the VM is NOT torn down so evidence is preserved).
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
agent | opaque agent id | false |
enclave | opaque enclave id | true |
published | boolean: the policy snapshot was republished | true |
nudged | boolean: the enclave was nudged to re-pull | true |
agent.release
Meaning: An operator RELEASED a contained agent, restoring its prior policy surface and agent-operator authority.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
agent | opaque agent id | false |
enclave | opaque enclave id | true |
published | boolean: the policy snapshot was republished | true |
nudged | boolean: the enclave was nudged to re-pull | true |
forensics.snapshot
Meaning: The node forensics daemon captured a contained agent’s Kata VM state (guest RAM + rootfs + sandbox metadata) into the enclave’s node run dir for evidence.
- Plane:
enclave - Component:
forensics - Record class:
audit_event - Evidence tiers:
completion - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
agent | opaque agent id | false |
namespace | agent namespace | true |
sandbox | kata sandbox id | true |
files | non-negative integer | true |
took_ms | milliseconds | true |
error | failure reason | true |
enclave.agentid_ca.pin
Meaning: An operator changed the controlplane’s pinned agent-identity CA roots for an enclave.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
fingerprint | certificate fingerprint | false |
node_id | node id | false |
org.claim.provision
Meaning: The controlplane provisioned, rejected, or failed to write a principal’s org claim.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny,error
Attrs: none
serviceaccount.create
Meaning: An operator created an org service account (a machine user that acts as an operator); its credential crossed the boundary exactly once.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
service_account | opaque dvx service-account id | false |
level | org|self-service | false |
serviceaccount.key.mint
Meaning: An operator minted a new credential for a service account (creation or rotation); the key material crossed the boundary exactly once.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
service_account | opaque dvx service-account id | false |
rotated | boolean: a prior key id was retired | true |
serviceaccount.transfer
Meaning: An org administrator transferred a self-service service account to a new owner; later grant changes are bounded by the new owner’s delegation ceiling.
- Plane:
controlplane - Component:
iam - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
service_account | opaque dvx service-account id | false |
owner | new owner’s subject | false |
token.issue
Meaning: The controlplane token facade (POST /oauth/token) forwarded or refused an RFC 7523 jwt-bearer token request from an unauthenticated caller; the assertion is verified by the identity issuer, never by dvx, and neither assertion nor token material is ever recorded.
- Plane:
controlplane - Component:
oauth - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,deny,error
| Attr | Domain | Optional |
|---|---|---|
grant_type | requested OAuth grant type (only the jwt-bearer grant is forwarded) | true |
assertion_sub_unverified | UNVERIFIED sub claim of the presented assertion, length-capped; the issuer, not dvx, verifies the assertion, so this value is untrusted client input recorded for correlation only | true |
upstream_status | HTTP status the identity issuer’s token endpoint returned | true |
controlplane.govpolicy.publish
Meaning: The controlplane published the governance policy snapshot consumed by an enclave.
- Plane:
controlplane - Component:
govpolicy - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
path | node-local path | false |
version | positive integer | false |
enclave_id | opaque enclave id | false |
org_id | opaque org id | false |
settings | non-negative integer | false |
controlplane.attestpolicy.publish
Meaning: The controlplane published the reference values used by the enclave attestation gate.
- Plane:
controlplane - Component:
attestpolicy - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
path | node-local path | false |
tee_types | TEE type list | false |
measurements | non-negative integer | false |
min_tcb | TCB value | false |
min_svn | SVN value | false |
controlplane.configvalue.publish
Meaning: The controlplane published resolved configuration values for an enclave.
- Plane:
controlplane - Component:
configvalue - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
path | node-local path | false |
version | positive integer | false |
enclave_id | opaque enclave id | false |
org_id | opaque org id | false |
settings | non-negative integer | false |
controlplane.org.erasure.begin
Meaning: The controlplane began the grace-window transition for org erasure.
- Plane:
controlplane - Component:
offboarding - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
org_id | opaque org id | false |
status | destroying | false |
controlplane.org.erasure.complete
Meaning: The controlplane reported the result of deleting an org’s data and shredding its key.
- Plane:
controlplane - Component:
offboarding - Record class:
audit_event - Evidence tiers:
authority - Outcomes:
allow,error
| Attr | Domain | Optional |
|---|---|---|
org_id | opaque org id | false |
key_shredded | boolean | false |
rows_swept | integer | false |
status | erased | false |
imds.start
Meaning: The IMDS daemon started.
- Plane:
enclave - Component:
imds - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
enclave_id | opaque enclave id | false |
enclave_name | display name | false |
broker.start
Meaning: The enclave broker started.
- Plane:
enclave - Component:
broker - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
enclave_id | opaque enclave id | false |
enclave_name | display name | false |
controlplane | controlplane URL | false |
gateway.start
Meaning: The network gateway started.
- Plane:
enclave - Component:
gateway - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
enclave_id | opaque enclave id | false |
enclave_name | display name | false |
relay.start
Meaning: The external relay started.
- Plane:
enclave - Component:
relay - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
enclave_id | opaque enclave id | false |
enclave_name | display name | false |
broker | broker URL | false |
rendezvous | boolean | false |
llmproxy.start
Meaning: The LLM satellite started.
- Plane:
enclave - Component:
llmproxy - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
enclave_id | opaque enclave id | false |
enclave_name | display name | false |
min_tier | attestation tier | false |
controlplane.start
Meaning: Controlplane management services started.
- Plane:
controlplane - Component:
controlplane - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
version | build version | false |
audit.heartbeat
Meaning: A component’s periodic liveness heartbeat in the audit stream (bd_2_0-4p8.5): expected-but-absent heartbeats under one boot_id let a reader resolve silence into quiet versus loss, including across restart (a sequence resetting under a NEW boot_id is a restart, not a loss) and WAL replay (replayed heartbeats keep their original order and boot_id, so no false gap).
- Plane:
enclave|controlplane - Component:
broker|gateway|imds|llmproxy|controlplane - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
boot_id | random per-process identifier (hex); stable for one component lifetime | false |
heartbeat_seq | per-boot monotonic sequence starting at 1 | false |
interval_seconds | configured heartbeat interval in seconds | true |
audit.gap
Meaning: The audit store reports records it lost (bd_2_0-4p8.4): one recovered loss window, promoted from the bounded on-disk loss ledger beside the WAL on the store’s first successful flush after the loss (and at startup after replay). Retrospective by construction - a gap record written at the moment of loss would fail with the failure it reports - so a MISSING gap record proves nothing; the counters (dvx_auditstore_dropped_total / dvx_auditstore_lost_total) remain the machine source of truth, and the per-component heartbeat (audit.heartbeat) covers the unrecoverable losses (disk gone, node dead, SIGKILL).
- Plane:
enclave|controlplane - Component:
broker|gateway|imds|llmproxy|controlplane - Record class:
audit_event - Evidence tiers:
telemetry - Outcomes:
allow
| Attr | Domain | Optional |
|---|---|---|
gap_table | network_flow|audit_event|inference_request | false |
gap_cause | wal_full|wal_append_error|unreadable_batch|flush_lost|buffer_full | false |
gap_count | positive integer (approximate record count lost in the window) | false |
gap_first | RFC3339 timestamp of the window’s first drop | false |
gap_last | RFC3339 timestamp of the window’s last observed drop | false |
boot_id | random per-process identifier (hex); joins the gap against the component’s audit.heartbeat stream | true |
inference.request
Meaning: A typed inference evidence record for one governed LLM request.
- Plane:
enclave - Component:
llmproxy - Record class:
inference_request - Record form:
request|completion - Evidence tiers:
authority,completion - Outcomes:
allow,deny
| Attr | Domain | Optional |
|---|---|---|
request_id | UUIDv7 | false |
model | model name | false |
provider | registered provider | false |
endpoint | format and path | false |
credential_mode | passthrough|inject | false |
verdict | governance verdict | false |
input_tokens | non-negative integer | false |
output_tokens | non-negative integer | false |
latency_ms | non-negative integer | false |
status_code | HTTP status | false |