Telemetry
Security and audit SQL recipe

Audit AI Agent Tool Authorization Decisions

Review allowed, denied, and approval-required agent tool decisions by risk class without collecting prompts, tool arguments, results, or credentials.

Beginneragent_tool_authorization_decisionsReviewed 2026-07-30Tested with Apache DataFusion 45.2.0

Reviewed by the Telemetry product team on . SQL compatibility, event contract, synthetic output, and operational caveats. Review standards and ownership

Question answered

Which agent tools are denied or routed to human approval most often?

Agent security analysis starts at the enforcement boundary. This query preserves decision volume, denial count, approval demand, and allowed count by tool and risk class so teams can review a policy change without interpreting raw tool payloads.

Event contract

Fields the query expects

FieldTypeWhy it exists
timestamp_utcTimestampFinal policy-decision time in UTC.
workflowUtf8Versioned, low-cardinality agent workflow.
tool_nameUtf8Approved low-cardinality tool identifier.
action_classUtf8Controlled class such as read_only or external_state_change.
risk_levelUtf8Reviewed low, medium, or high risk class.
decisionUtf8Allowed, denied, or approval_required.
reason_codeUtf8Controlled policy reason without a free-form model explanation.
policy_versionUtf8Version of the policy contract used for the decision.
environmentUtf8Deployment environment.
DataFusion SQL

Copy the query

sql
SELECT
  tool_name,
  risk_level,
  COUNT(*) AS decisions,
  SUM(CASE WHEN decision = 'denied' THEN 1 ELSE 0 END) AS denied,
  SUM(CASE WHEN decision = 'approval_required' THEN 1 ELSE 0 END) AS approval_required,
  SUM(CASE WHEN decision = 'allowed' THEN 1 ELSE 0 END) AS allowed,
  100.0 * SUM(CASE WHEN decision = 'denied' THEN 1 ELSE 0 END)
    / NULLIF(COUNT(*), 0) AS denial_rate_pct
FROM agent_tool_authorization_decisions
WHERE timestamp_utc >= now() - INTERVAL '30 days'
  AND environment = 'production'
GROUP BY tool_name, risk_level
ORDER BY denied DESC, approval_required DESC, tool_name;

This read-only query is planned and executed against an empty typed table with Apache DataFusion 45.2.0. The deterministic sample output is synthetic and reviewed separately; validate field types, thresholds, and business definitions against your own data. Read the testing methodology.

Query result

Agent tool denial rate

Synthetic decisions keep denial rate beside approval and total volume for each tool.

tool_namerisk_leveldecisionsdeniedapproval_requiredalloweddenial_rate_pct
database_writehigh421150
filesystem_writehigh412125
web_searchmedium30030

Synthetic example output. Run the query against your own event schema and thresholds before using it for operational decisions.

Agent tool denial rate: static chart of synthetic denial_rate_pct values from the Audit AI Agent Tool Authorization Decisions example result
Indexable SVG of the deterministic example output. Download it for an article, runbook, or design review with attribution.

Reproduce the example

Download the public fixture

The JSON bundle includes the typed event contract, reproducible input rows, exact SQL, expected output, review notes, and engine version. The CSV contains the displayed result.

Run in browserJSON fixtureExpected output CSVStatic SVG chart

How the SQL works

  1. 1The decision is emitted by the authorization layer before execution, not inferred from the model's requested action.
  2. 2Tool name, risk level, reason code, and policy version use controlled values so policy changes remain comparable.
  3. 3Counts remain visible beside denial rate because a high percentage over a few decisions should not trigger an automatic escalation.

Edge cases to decide

  • An expected denial can show policy working; define reviewed escalation conditions before alerting.
  • Log the terminal tool outcome separately so an allowed decision is not mistaken for successful execution.
  • Keep prompts, arguments, results, credentials, retrieved documents, and free-form policy explanations outside general telemetry.

Recommended dashboard

  • Bars: denial_rate_pct by tool_name
  • Stacked decisions: allowed, denied, and approval_required by risk_level
  • Trend: decision mix by policy_version and release

Alert guidance

Alert only on reviewed conditions such as a sustained high-risk denial spike, a novel tool class, or an overdue approval queue with sufficient volume.

Read alert setup

Put the recipe to work

Related instrumentation and guides

AI agent security monitoring use caseAI agent security monitoring guideAI agent authorization event schemaModel Context Protocol integration

Define the source data

Event schemas for this analysis

agent_tool_authorization_decided

A policy decision recorded before a consequential agent tool call. It captures bounded tool, risk, decision, and policy fields while excluding prompts, arguments, results, credentials, and customer content.

Review schema

Continue the analysis

Analyze Authentication Failure Rate

Measure authentication failures by method and reason while keeping traffic volume and affected identities visible.

Open recipe

Audit Privileged Actions with SQL

Summarize sensitive administrative actions, denied attempts, and review-required outcomes without collecting raw secrets or resource contents.

Open recipe

Detect Suspicious Authentication Bursts

Find short authentication windows with repeated failures across many identities or coarse network sources.

Open recipe

Run it on real events

Create a table, adapt the fields, and save the result

Start free, send structured events, and use the query result as a chart, shared dashboard widget, or alert input.

Get an API key