audit_log

What audit_log does on Iconnect

AI agents call audit_log to retrieve information from Iconnect without modifying anything. It is typically the context-gathering step in research, monitoring, and reporting workflows, before the agent takes action elsewhere.

Why audit_log is rated Low

This tool retrieves and queries historical audit log data from local JSONL files without modifying, deleting, or executing code. It is a pure Read operation. Severity is medium rather than low because audit logs may contain sensitive information about user activities, credentials, or system state that could be exposed if an AI agent queries it without authorization, though the tool itself is read-only and poses no…

From the tool's definition Tool name 'audit_log' and description explicitly states 'Query the on-device audit log' and 'Reads JSONL rows from' a local file. The verb 'Query' and 'Reads' confirm read-only retrieval.

The rule that runs audit_log safely

PolicyLayer is an MCP gateway: it sits between your AI agents and Iconnect, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For audit_log, this is the rule to start with:

{
  "version": "1",
  "default": "deny",
  "tools": {
    "audit_log": {}
  }
}

Questions about audit_log