What does StackOne log for AI agent activity?

StackOne logs three kinds of activity. Action logs record each call to a business system and its outcome. Platform logs record changes to StackOne configuration. Sign-in logs record who signed in and how, through SSO or other permitted methods. Member identity, policy details and Defender results appear when the caller and checks provide them.

Is action logging on by default in StackOne?

Yes. StackOne records action logs by default, with no setup. Advanced Logs, which stores request and response bodies, is off by default and you turn it on when you need it.

Can I see why a StackOne Permission Policy blocked a call?

Yes. Each member-based action in the StackOne logs shows which Permission Policies were evaluated, whether each one matched, its mode and its decision. Open the denied request to see the policy that blocked it and the version in force at the time.

Can I test a StackOne Permission Policy without blocking anyone?

Yes. Set a StackOne Permission Policy to Monitor only and it records what it would have denied without blocking anyone. Review those decisions in the logs, then switch the policy to Enforce. Other enforced policies and access controls still apply while you test.

Does StackOne export logs to my SIEM?

Yes, through the Logs API. Your pipeline pulls supported StackOne records and forwards them to tools such as Splunk or Datadog. The Logs API is included in Gateway Enterprise and both OEM plans. Audit logs and SIEM export are Enterprise features, and we agree the export setup with you.

Are Prompt Injection Guard results in the StackOne logs?

Yes, when Prompt Injection Guard scans a tool response. Its verdicts and scores appear in the action's Defender details in StackOne, and through the Defender action-log endpoint. Which scan stages appear depends on the scan that ran.

Observability & Audit · Action and audit logs. Audit how your teams use AI agents across business systems.

Review action outcomes and the policies evaluated.

Start Free Book Demo

Action logs

21 Sep 2026UTC

Recent actions Policies Defender

User / Agent	System / Action	Outcome / Checks
Taylor Brooksvia Copilot	SAP S/4HANA 12:41:33	200 2 Clean
Noah Patelvia Claude Code	Jamf Pro 12:42:10	200 2 Clean
Alex Morganvia Claude	Workday 12:43:51	200 3 Clean
Lena Ortizvia Copilot	Salesforce 12:44:06	200 2 Clean
Priya Shahvia Claude Code	Xero 12:45:19	403 3 Not run
Sam Riveravia Claude Code	ServiceNow 12:46:32	201 2 Clean
Alex Morganvia Claude Code	Workday 12:47:58	200 3 Clean

Workday

Get Worker

21 Sep · 12:47:58 UTC

200 OK Clean

User / Agent: Alex Morgan via Claude Code
Account: People Operations

Policies evaluated3

Protect personal dataMasked

EnforceMatchedResponse filtering

Field groupPersonal datapii

Personal data masked before reaching the agent.

Keep salaries unchangedNo match

Review worker lookupsMonitor onlyWould deny

2 other policiesNo match · Would deny

Worker lookup completed

Action, platform and sign-in logs. Review tool calls, setup changes and sign-ins.

See the outcome of every tool call, setup change and sign-in.

Action logs

21 Sep 2026UTC

Recent actionsSelect a row for details

Action logs on 21 Sep 2026
User / Agent	System / Action	Outcome
Jordan Blake via ChatGPT	Salesforce12:35:12	200 198 ms
Sam Rivera via ChatGPT	ServiceNow12:36:40	201 534 ms
Taylor Brooks via Copilot	SAP S/4HANA12:38:27	404 126 ms
Alex Morgan via Claude	Workday12:41:09	200 286 ms
Noah Patel via Claude Code	Jamf Pro12:43:24	200 231 ms
Daniel Okafor via Claude	NetSuite12:44:51	200 412 ms
Priya Shah via Claude Code	Xero12:45:19	403 38 ms

Xero

Create Payment

21 Sep · 12:45:19 UTC

403 Denied

Priya Shah

via Claude Code

Account: Finance
Decided by: Restrict payment creation
Policies evaluated: 3
Duration: 38 ms

Payment refused by policy

Platform logs

21 Sep 2026UTC

Recent changesSelect a row for details

Platform logs on 21 Sep 2026
Changed by	Change / Target	Result
API key No user recorded	Workday · People Operations09:35:02	Success 201 Created
Noah Patel User session	Jamf Pro · IT Support09:41:27	Success 200 OK
SCIM Directory sync	Finance approvers09:58:10	Success 200 OK
Hannah Weiss User session	Xero · Finance approvers10:26:33	Success 200 OK
Lena Ortiz User session	Restrict payment creation11:02:14	Success 200 OK
API key No user recorded	Organization11:47:12	Success 200 OK
Hannah Weiss User session	Finance reporting12:31:40	Success 201 Created

Finance reporting

API key created

21 Sep · 12:31:40 UTC

201 Created

Recorded user: hannah@northwind.example
Authentication: User session
Project: Production
HTTP result: 201 Created

Key created in Production

Sign-in logs

21 Sep 2026UTC

Recent sign-insSelect a row for details

Sign-in logs on 21 Sep 2026
Member	Event / Method	Result
Noah Patel noah@northwind.example	Dashboard09:31:07	Success SAML
Hannah Weiss hannah@northwind.example	Dashboard10:21:48	Success SAML
Ravi Menon ravi@northwind.example	All sessions10:30:44	Revoked SCIM
Lena Ortiz lena@northwind.example	Dashboard10:57:31	Success SAML
Maya Chen maya@northwind.example	Dashboard · Password11:58:36	Failed SSO required
Jordan Blake jordan@northwind.example	ChatGPT12:22:51	Success OAuth
Priya Shah priya@northwind.example	Claude Code12:40:03	Success OAuth

Policy decision audit trail. Test a policy in Monitor only, then enforce it.

Monitor only records what a policy would have denied without blocking anyone. The logs show each decision before and after you switch.

Restrict payment creationCreate Payment in Xero · decisions per hour

The policy matched just as often after the switch. In Monitor only it logged each payment it would have stopped and blocked none; in Enforce it denied them.

Explore Permission Policies

Request and response logging. Keep request and response bodies.

Store the bodies of failed actions, or all of them, for up to 30 days, or as long as you need when you self-host.

New action with these settings

Get Supplier

SAP S/4HANA · Procurement

Action recorded

404 Not Found

Response excerptStored · 7 days

{
  "error": {
    "message":
      "Supplier not found."
  }
}

{
  "Supplier": "0000100042"
}

Logs API and SIEM export. Send action and platform logs to your own tools.

Pull records through the Logs API to investigate agent activity or report on your rollout.

StackOne

Logs API

api.stackone.com

POST /logs Action and request logs
POST /logs/platform Setup changes made in StackOne
POST /logs/stats/aggregate Counts by connector, outcome or policy result
GET /logs/actions/{actionRunId} One tool call
GET /logs/actions/{actionRunId}/policy The policy decision on that call

{ "data": [{"log_type": "action","event_time": "2026-09-21T12:45:19Z","action_id": "xero_create_payment","status_code": 403,"success": false,"duration_ms": 38}] }