AI Agent Security Event Template

Template evidence path

AI Agent Security Audit Template: implementation to decision

Treat the prompt as an implementation brief. The useful artifact is not copied code alone, but a reviewed event contract that produces a trustworthy answer.

1
Select the boundary
Instrument the point where agent_tool_authorization_decided becomes final.
2
Create the contract
Start with agent_tool_authorization_decided, agent_tool_completed, agent_policy_changed and keep every field typed, bounded, and privacy-reviewed.
3
Run a fixture
Exercise known success, failure, retry, and empty-result cases before relying on aggregate results.
4
Answer the question
Which high-risk tools are denied or require approval?

Template versus use case

This page is the implementation brief

Copy this template when the measurement goal is already clear. Use the matching use-case guide to review event boundaries, success definitions, and the decisions the resulting SQL should support.

Read AI Agent Security Monitoring

Template

Paste this into your coding agent

Replace YOUR_API_KEY, run the flow locally, then verify the generated events and dashboards.

ai-agent-security-audit

AI Agent Security Audit Template

text

Instrument AI agent security decisions with Telemetry.

Use /skill.md and this Telemetry API key: YOUR_API_KEY

At the authorization boundary, log agent_tool_authorization_decided with:
event_id, run_id, tool_call_id, workflow, agent_name, tool_name, action_class, risk_level, decision, reason_code, policy_version, release, environment, and timestamp_utc.

Use controlled values for action_class, risk_level, decision, and reason_code. Emit the authorization decision before execution, then log agent_tool_completed separately with the same correlation identifiers, status, duration_ms, and a bounded error_type.

Create reviewed SQL for decision volume, denial rate, approval-required volume, policy-version changes, and allowed actions that later fail. Keep absolute counts beside rates.

Do not log prompts, completions, credentials, authorization headers, tool arguments, tool results, retrieved content, customer data, or free-form policy explanations. Keep enforcement in the policy layer; Telemetry is the analysis surface.

Events to capture

agent_tool_authorization_decidedagent_tool_completedagent_policy_changedagent_approval_resolvedagent_run_completed

Verification checklist

What a complete instrumentation pass leaves behind

Events

Synthetic events reach the intended table with stable names and field types.

Queries

The first SQL queries return plausible rows with an explicit time window.

Views

A dashboard uses the real fields and includes enough context to explain a change.

Safety

Prompts, bodies, credentials, signatures, and private content were checked for redaction.

Event schema starting points

Review the row grain, emit boundary, required types, privacy classes, example payload, and validation checklist before adapting a query or snippet to production.

AI agent security12 fields