Docs navigation

Replay

Replay reconstructs a workflow step by step from the audit log: what task the agent received, what it decided, which tools it called, what policy said, and how trust moved — in order, with policy and security steps highlighted. Nothing is re-executed; it is a faithful reconstruction of the record.

In the dashboard

Every agent detail page has a Replay ▶ button. Pick a workflow, then step forward/back through the run. Blocked actions, invalid signatures, and approval gates are visually flagged at the exact step they happened.

Over the API

GET /api/workflows/wf_refund_8412/replay

{
  "workflow": { "id": "wf_refund_8412", "name": "Customer refund request",
                "status": "completed", "agentId": "support-agent" },
  "steps": [
    { "step": 1, "label": "Agent received task — Received refund request…",
      "policyDecision": "allow", "highlight": false, … },
    { "step": 2, "label": "Agent called tool refund_lookup",
      "policyDecision": "allow", "signatureValid": true, … },
    { "step": 3, "label": "Agent made a decision — Refund approved under policy",
      "trustScoreBefore": 92, "trustScoreAfter": 92, … },
    { "step": 4, "label": "Workflow step — Refund issued",
      "policyDecision": "allow", … }
  ]
}

Incident investigation

When something goes wrong: open the agent, find the workflow marked failed or blocked, replay it to the highlighted step, then pull the surrounding evidence — GET /api/agents/:id/security-events for the violations and POST /api/audit/verify to prove the record itself is intact. Together that is an incident report a compliance team can trust.

Note

Because every step is part of the hash chain, a replay is not "logs that might have been edited" — it is a record that provably wasn't. See Audit events.