Audit Log Schema — Network-AI v6.0.1

Network-AI writes a JSONL audit trail during permission management and swarm execution. This document describes every field and event type.

File Location

data/audit_log.jsonl

One JSON object per line. The file is append-only. Each entry is a complete, self-contained record — no dependencies between lines.

The CLI provides direct access without inspecting the file manually:

network-ai audit log            # print all entries (add --limit <n> to cap output)
network-ai audit tail           # live-stream new entries as they are appended
network-ai audit clear          # reset the log (irreversible)
network-ai --json audit log     # machine-readable output

Envelope (all events)

Every log entry uses the same outer structure:

{
  "timestamp": "2026-02-28T14:32:01.123456+00:00",
  "action":    "<event_type>",
  "details":   { ... }
}

Event Types

The model.* events are emitted by the TypeScript engine's GovernedModelGateway to its configured audit sink (e.g. SecureAuditLogger), capturing the refusal → fallback → billing lifecycle. Their details carry model, stopReason, refusalCategory, servedByFallback, creditRedeemed, costUsd, and usage.

Per-Event details Schemas

permission_request

{
  "agent_id":      "data_analyst",
  "resource_type": "DATABASE",
  "justification": "Need customer order history for Q1 sales report",
  "scope":         "read"
}

permission_granted

{
  "token":         "grant_a1b2c3d4e5f67890abcdef1234567890ab",
  "agent_id":      "data_analyst",
  "resource_type": "DATABASE",
  "scope":         "read",
  "expires_at":    "2026-02-28T14:37:01.123456+00:00",
  "restrictions":  ["read-only", "no-schema-changes"],
  "granted_at":    "2026-02-28T14:32:01.123456+00:00"
}

permission_denied

{
  "agent_id":      "untrusted_bot",
  "resource_type": "PAYMENTS",
  "reason":        "Combined evaluation score (0.31) below threshold (0.5).",
  "scores": {
    "justification": 0.25,
    "trust":         0.40,
    "risk":          0.90,
    "weighted":      0.31
  }
}

permission_revoked

{
  "token":    "grant_a1b2c3d4e5f67890abcdef1234567890ab",
  "agent_id": "data_analyst",
  "reason":   "manual revocation"
}

ttl_cleanup

{
  "removed_tokens": ["grant_abc...", "grant_def..."],
  "count":          2
}

budget_initialized

{
  "ceiling": 5000,
  "unit":    "tokens"
}

handoff_allowed

{
  "from_agent": "orchestrator",
  "to_agent":   "implementer",
  "task":       "implement payment service",
  "budget_remaining": 4120
}

handoff_blocked

{
  "from_agent": "implementer",
  "to_agent":   "orchestrator",
  "reason":     "budget_exceeded",
  "budget_used": 5100,
  "budget_ceiling": 5000
}

safety_shutdown

{
  "reason":         "budget_ceiling_breached",
  "budget_used":    5100,
  "budget_ceiling": 5000,
  "agent":          "rogue_agent"
}

Scoring Reference

Permission decisions use a three-factor weighted score:

Approval threshold: 0.50. Requests below this are logged as permission_denied.

Node.js Layer (TypeScript package)

When using the network-ai npm package directly, the SecureAuditLogger class in security.ts produces HMAC-SHA256-signed entries with the same envelope format plus a signature field. This is separate from the Python script layer described above.

v5.0 Event Types

The following event types were added in v5.0:

v5.10 Event Types

The following event types were added in v5.11.0 (ClaimVerifier / Tier 1 agent honesty):

v5.17 Perpetual Runtime Events

Opt-in. These go to separate JSONL files written by the CLI processes (or to your own sink through each component's onEvent callback), so a sentry can tail them read-only. Timestamps are epoch milliseconds in at. No secrets are ever written.

data/perpetual_audit.jsonl — one line per LeaseAuthority decision:

{ "source": "lease-authority", "at": 1800000000000, "action": "renew", "role": "runner", "runId": "research-swarm", "leaseId": "lease_3f…", "reason": null }

Since v6.0.0, refuse and stop reasons also include human checkpoint overdue, capability evaluation required…, authority halted: <tripwire or sentry quorum> (latched until an operator resume), attestation failures (attestation evidence missing, attestation nonce is stale or replayed, attested measurement is not on the policy list, …), and cosign: … for co-sign refusals (for example cosign: claims are not signed by their issuing authority). A tripwire revoke carries reason: "tripwire reported by sentry:proxy".

data/egress_audit.jsonl — one line per EgressProxy decision:

{ "source": "egress-proxy", "at": 1800000000000, "outcome": "denied", "route": "pay", "leaseId": "lease_3f…", "runId": "research-swarm", "status": 403, "reason": "amount would exceed the per-run limit" }

outcome is forwarded, denied, or error; status is the HTTP status returned to the agent. Since v6.0.0 a request carrying a decoy credential is logged as denied with reason: "tripwire: <decoy label>" (the agent only sees a generic 403 forbidden), and an accept-risk line is written when the proxy starts despite a failed posture check.

VsockRelay / SpoolPuller (v6.0.0, via onEvent): { "at", "kind": "request" | "drop" | "close", "type"?, "reason"? } — drop for frames that fail the fixed schemas, rate limits, or the in-flight cap; close for oversize or malformed frames.

Merkle audit (v6.0.0, optional): HashChainSink with { merkle } appends every chained event to a MerkleAuditLog; signed tree heads (nai-sth-v1: size, root, timestamp, logId) and consistency proofs go to an external witness.

data/sentry_<id>.jsonl — one line per finding: { "sentry", "detector", "level" (info|warning|critical), "reason", "agentId", "runId", "at" }. Detectors: velocity, denied-access, prompt-injection, blackboard-poisoning, guarded-touch, canary-leak, goal-drift, tripwire (v6.0.0: decoy file touched or decoy credential used).

Runtime / blackboard entries gain one field when the Perpetual Runtime refuses a write: AgentRuntime file_write entries with result: "blocked" carry details.lease or details.guarded; LockedBlackboard logs BLACKBOARD_WRITE with action guarded and outcome denied (details.key, details.reason).

Retention & Privacy

• The log is append-only. There is no built-in rotation — implement log rotation at the infrastructure level (e.g. logrotate, S3 lifecycle policy).
• No PII is logged by default. Justification text is logged as-provided — avoid including PII in justification strings.
• No API keys, tokens in cleartext, or sensitive resource content are logged.