Skip to Content
FlowInvestigationsAutopilotFlight Recorder & Audit

Flight Recorder & Audit

Autopilot is built so you never have to take its word for anything. Every cycle is captured in the Flight Recorder: a complete, readable record of what each agent did, what it chose not to do, and the reason behind every decision. It’s a flight recorder, not a black box.

You’ll find it in the Harness panel, alongside an Activity timeline that spans every run.


How a run is recorded

  • Run list — every cycle in order, each with a status dot (succeeded, running, or failed), a short summary, and a timestamp. While a run is in progress the view updates live.
  • Run detail — open any cycle to see what triggered it (a scan, a schedule, or your manual instruction), the individual decisions, and the logs.

Decision cards — the heart of it

Each thing an agent decided becomes a decision card. This is where the “explains itself” promise lives:

On the cardWhat it tells you
Outcome badgeWhether the decision was applied, was observe-only (proposed, nothing changed), or failed.
ActionWhat it did, in plain terms — “opened case: credential exposure,” “enabled secrets detector on wiki source.”
RationaleA written reason for the decision. This is mandatory — every action and every deliberate non-action has one.
DetailsThe specifics behind the action, expandable when you want to dig in.

Because non-actions are recorded too, you can see not just what Autopilot changed, but what it considered and deliberately left alone — and why.


Two ways to read the logs

Each run’s logs come in two channels, so the right person gets the right level of detail:

ChannelWho it’s forWhat it reads like
Business narrativeAnalysts, reviewers, auditorsPlain English: “Reviewed 42 new findings, grouped 6 into an existing case, opened 1 new inquiry.”
Technical logOperators debugging behaviourA detailed, step-by-step trace of the run for when you need to see exactly what happened.

Most of the time the business narrative is all you need. The technical channel is there for the moments you want to verify a specific step.


The run dashboard

The top of the Harness panel summarises Autopilot’s recent health at a glance:

MetricMeaning
Active runsCycles running right now
Runs (24h)How busy Autopilot has been today
AppliedChanges actually made
Observe-onlyProposals that were logged but not applied
FailedDecisions that couldn’t complete
Memory entriesHow much Autopilot has learned
Brief versionHow current the System Brief is

A healthy instance running in managed mode shows mostly applied decisions; one you’ve kept in observe-only shows mostly observe-only — exactly the proposals waiting for your review.


Why this matters

  • Trust through transparency. Nothing happens silently. If Autopilot opened a case or changed a source, the reason is one click away.
  • Audit-ready. Every action is attributed and timestamped, so the record stands up to a compliance or security review.
  • A feedback loop. Reading the rationale on a decision you disagree with tells you exactly which guidance or operator directive to adjust — see Steering & Fine-Tuning.

You’ve seen the whole picture

That completes the tour of Autopilot — from the big idea to the details:

Page
OverviewWhat Autopilot is and why it exists
Meet the AgentsThe five agents and what each changes
How a Cycle RunsTriggers, the run rhythm, and observe-only
Memory & System BriefHow it stays grounded and learns
Steering & Fine-TuningEvery knob you can turn
Flight Recorder & AuditHow to read what it did (you are here)
Last updated on