Module: Ask::Rails::Harness::AuditLog

Defined in:
lib/ask/rails/harness/audit_log.rb

Overview

Append-only audit log for tool executions.

Every tool call made by an agent is recorded in the ask_audit_logs table with the intent (sanitized params) and outcome (status, timing), but not the data returned. This gives a trustworthy, queryable record of what the agent did without becoming a PII liability.

Sensitive param values (keys matching password, secret, token, api_key, key) are automatically redacted before logging.

Constant Summary collapse

SENSITIVE_KEYS = 
/\A(password|secret|token|api_key|key|auth_token|access_token)\z/i

Class Method Summary collapse

Class Method Details

.log(session_id:, tool_name:, params:, result: nil, error: nil, duration_ms:) ⇒ Object

Log a tool execution event.

Parameters:

  • session_id (String) —

    The agent session that triggered this call

  • tool_name (String) —

    Name of the tool that ran

  • params (Hash) —

    The parameters passed to the tool (sanitized automatically)

  • result (Ask::Result, Hash, nil) (defaults to: nil) —

    The result returned by the tool

  • error (StandardError, nil) (defaults to: nil) —

    The exception if the tool raised

  • duration_ms (Integer) —

    Wall-clock time for the tool execution

  • user_context (Hash, nil) —

    Who initiated the session (from config)



30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
 
# File 'lib/ask/rails/harness/audit_log.rb', line 30

def log(session_id:, tool_name:, params:, result: nil, error: nil, duration_ms:)
  now = Time.now.utc
  entry = {
    session_id: session_id,
    tool_name: tool_name,
    params: sanitize_params(params),
    result_summary: build_summary(tool_name, result, error),
    status: determine_status(result, error),
    error_message: determine_error(result, error),
    duration_ms: duration_ms,
    user_context: resolve_user_context,
    environment: environment_name,
    recorded_at: now,
    created_at: now,
    updated_at: now
  }

  if table_exists?
    write_entry(entry)
  end

  # Fire an ActiveSupport notification so host apps can subscribe
  ActiveSupport::Notifications.instrument("audit_log.ask_rails_harness", entry)

  entry
end

.reset_table_check! ⇒ Object 



176
177
178
 
# File 'lib/ask/rails/harness/audit_log.rb', line 176

def reset_table_check!
  @table_exists = nil
end