AI agent security event template

How to test this template

Set up AI agent security audit template and check the results

Use the prompt to add events, then check the stored fields and query results. Review the event definitions before relying on the numbers.

1
Choose when to log
Instrument the point where agent_tool_authorization_decided becomes final.
2
Create the contract
Start with agent_tool_authorization_decided, agent_tool_completed, agent_policy_changed and keep every field typed, bounded, and privacy-reviewed.
3
Run a fixture
Exercise known success, failure, retry, and empty-result cases before relying on aggregate results.
4
Answer the question
Which high-risk tools are denied or require approval?

Template versus use case

Use this template to add events

Copy this template when the measurement goal is already clear. Use the matching use-case guide to review event boundaries, success definitions, and the decisions the resulting SQL should support.

Read AI agent security monitoring

Template

Paste this into your coding agent

Replace YOUR_API_KEY, run the flow locally, then verify the generated events and dashboards.

ai-agent-security-audit

AI agent security audit template

text

Instrument AI agent security decisions with Telemetry.

Use /skill.md and this Telemetry API key: YOUR_API_KEY

At the authorization boundary, log agent_tool_authorization_decided with:
event_id, run_id, tool_call_id, workflow, agent_name, tool_name, action_class, risk_level, decision, reason_code, policy_version, release, environment, and timestamp_utc.

Use controlled values for action_class, risk_level, decision, and reason_code. Emit the authorization decision before execution, then log agent_tool_completed separately with the same correlation identifiers, status, duration_ms, and a bounded error_type.

Create reviewed SQL for decision volume, denial rate, approval-required volume, policy-version changes, and allowed actions that later fail. Keep absolute counts beside rates.

Do not log prompts, completions, credentials, authorization headers, tool arguments, tool results, retrieved content, customer data, or free-form policy explanations. Keep enforcement in the policy layer. Use Telemetry to query the resulting events.

Events to capture

agent_tool_authorization_decidedagent_tool_completedagent_policy_changedagent_approval_resolvedagent_run_completed

Verification checklist

Check the events, queries, and dashboard

Events

Synthetic events reach the intended table with stable names and field types.

Queries

The first SQL queries return plausible rows with an explicit time window.

Views

A dashboard uses the real fields and includes enough context to explain a change.

Safety

You checked that events exclude prompts, bodies, credentials, signatures, and private content.

Example event schemas

Check what each event records, when to send it, and which field types it needs. Review the example payload and privacy checklist before using it in production.

AI agent security12 fields