Solution # The auditor asks what your agents ran. *Show one record.* Turn Protect on, and the gateway logs each tool call it blocks. Each rule change goes into a history where each entry's hash covers the one before it. [Get started free](https://console.context-mode.com/login) [Read the docs](https://context-mode.com/docs/protect) Ask Live Decision log History Insight What are our agents doing right now? Live shows *Running sessions* *Each request as it happens* *The saving per minute* Live shows running sessions and the saving per minute. In your terminal, a line that starts with context-mode · gives what a turn saved. What did Protect stop? Blocked **Push to protected branches** *Bash · git* Blocked **Read environment files** *Bash · cat* Would block **Change cloud resources** *Bash · aws* In each row - Time, decision, rule - Tool, program, host - Project, session, policy version Never in a row - Command text - Flag values - Environment values - File contents Would block: a rule in Monitor records the call and lets it run. Filter, then export as CSV or JSON Lines. Who loosened that rule, and why? ``` signed-in person · editor · adds a rule · tightens API key · import · adds a rule · tightens signed-in person · editor · deletes a block rule · loosens · reason kept Each entry's hash covers the one before it. ``` An API key can only tighten. Edit or delete an entry, and Verify record says where the chain breaks. Who is stuck, and on what? Insight answers by role *Owner: the whole org* *Manager: their teams* *Member: their own work* 222 patterns over events from the free Engine on each machine, with an Insight key. Insight does not read file contents. The problem ## Agents run commands all day. *Can you say which?* **"What did the agent run?"** An auditor asks. The answer sits in session files on each laptop, or nowhere. **"Who changed the rule?"** A block rule is gone. Nobody knows who removed it, or why. **"Was it blocked, or let through?"** A rule in test mode lets the call run. You need to see which calls it would have stopped. How it works ## One path for every request. *One record of it.* The gateway makes the record on the request path. A machine without the base URL is not in it, and Protect does not see that machine. 1. 01 **Point your agents at the gateway** *npx @context-mode/cli* sets the base URL in each agent's config. 2. 02 **Turn Protect on** Pick a preset. Try a rule in Monitor first: it records the call and lets it run. 3. 03 **Each Protect decision is logged** Once you turn Protect on: the rule, tool and program. A row never holds the command text, flag values, environment values or file contents. Proof ## Numbers you can check. *An audit log you can show.* **1 to 365 days** how long the decision log keeps rows; the default is 30 **403** for an API key that tried to turn Protect off **40-entry history** of policy changes checked out after the production run Each rule change sits in a history where each entry's hash covers the one before it. Protect checks only requests that go through the gateway; see [keep the gateway on](https://context-mode.com/docs/protect#pin). For what each request cost, see [Track agent spend](https://context-mode.com/use-cases/agent-spend-tracking). [The production run →](https://context-mode.com/blog/protect-rules-for-coding-agents) Where to look ## Each audit question *has one screen.* | Your question | Where you see it | What it holds | | --- | --- | --- | | What runs now? | Live | Running sessions, each request as it happens, the saving per minute | | What did it cost? | Analytics | Tokens, cost and saving over time, by session, project and agent. Not by person yet: there are no team roles. | | What was blocked? | Protect, Activity | The decision log: time, decision, rule, tool, program, host, project, session. "Would block" means a rule in Monitor recorded the call and let it run. Export as CSV or JSON Lines. | | What did no rule cover? | Protect, Activity | Programs, sites and tool servers your agents used, most used first, each with Block and Allow | | Who changed a rule? | Protect, History | Who, how, the rule before and after, the reason, and whether it loosens the policy | | Who is stuck? | Insight | Blockers, risks and changes, by person, team and project, from the free Engine on each machine, with an Insight key | Related: [secure coding agents](https://context-mode.com/solutions/secure-coding-agents), [cut agent spend](https://context-mode.com/solutions/cut-agent-spend), [team standards](https://context-mode.com/solutions/team-standards). Products used ## What this *uses.* **[Protect](https://context-mode.com/protect)** Checks every tool call before it runs. Logs each block and each rule change. **[Protect docs](https://context-mode.com/docs/protect)** The decision log fields, the History tab and how to verify the hash chain. **[Live and Analytics](https://context-mode.com/docs/how-saving-works)** How the console's ledger prices each request, and where you see the saving. **[Insight](https://context-mode.com/insight)** How your team works with agents, from free Engine events, answered by role. **[Pricing](https://context-mode.com/pricing)** Live, Analytics and Protect are in every plan, Free included. For Team, write to sales@context-mode.com. ## Know what your agents did. *Show it to an auditor.* *npx @context-mode/cli* connects your agents. 1,000 requests free, no card. [Get started free →](https://console.context-mode.com/login) [Talk to us about Team →](mailto:sales@context-mode.com)