Activity workspace
Filter operational evidence and inspect attempts, deliveries, receipts, outcomes, and correlation IDs.
Activity is a content-free operational ledger. It answers who or what acted, which resource was affected, the outcome, when it happened, and how to correlate related work without storing customer query results or provider record content.
Event families
| Family | Examples |
|---|---|
run | queued, started, completed, failed, canceled |
delivery | staged, committed, rejected, replayed |
authorization | requested, opened, completed, expired, revoked |
endpoint | enrolled, heartbeat, policy mismatch, revoked |
configuration | dataset selection, schedule, schema decision |
grant | created, expired, revoked, support policy use |
query | admitted, denied, succeeded, timed out, revoked |
deletion | requested, cleanup progress, proof recorded |
support | FDE access decisions and use |
backup / restore | recovery evidence and verification |
Filtering
Filter by family, Source, free-text operational fields, and ISO date range. Results are cursor-
paginated. Keep following nextCursor until it is null when completeness matters.
Every event includes an actor, resource, outcome (succeeded, failed, denied, or pending),
summary, optional Source and Run IDs, correlation ID, timestamp, and bounded scalar metadata.
Event detail
Open an event to inspect execution attempts, Deliveries, or a query receipt when relevant. Attempt facts can include heartbeat, CPU seconds, peak memory, record and byte counts, error code/message, and timing. Delivery facts include sequence, state, compressed bytes, record count, schema revision, snapshot, and commit time.
Investigation workflow
- Copy the
correlationIdfrom the UI, API error, or MCP error. - Filter Activity to the related Source and time window.
- Open the event and inspect attempts and Deliveries.
- For query failures, compare the attached receipt state, error code, grant versions, and limits.
- For authorization or Source failures, resolve the specific next action rather than repeatedly starting new requests.
Activity intentionally omits provider payloads, SQL result rows, secrets, raw Desktop media, and authentication tokens.