Audit trail & run traces

Turtle AI Coworker records what every worker does. Each run gets a run log: who or what started it, which worker ran, its status, duration, tokens and cost. Inside it, every tool call gets its own record: the tool, the integration, whether it read or wrote, the inputs it was given and the output it got back, with secrets stripped out. Policy decisions, approvals and changes made by admins are logged too.

You use the audit trail to debug a run that did the wrong thing, to answer "who sent that email and why", and to hand evidence to a reviewer. Most of the time you reach it from the worker itself (an agent's Run History, a team session, an employee's task). The Compliance screen holds the workspace-wide views: policy evaluations, admin activity and the audit report export.

What gets recorded

Tool calls are held in memory while a run executes and written in one batch when it ends, so recording adds no database work to each step. Before anything is stored, inputs and outputs are sanitized:

• Values under sensitive field names (such as password, token, secret, api_key, authorization, credentials) are replaced with [REDACTED].
• Secrets inside text are redacted too: API keys, bearer tokens, card-length numbers, GitHub and Slack tokens, and the signature part of signed file links (the rest of the link stays readable, so you can still tell which file was sent).
• Whole files embedded in a call as base64 are not stored.
• If personal data is detected in a call, the record is flagged with the kinds found. See Data Privacy in Policies, budgets & guard rails.

Each tool call is labelled read or write. The label comes from the function's entry in the platform's function catalog, or from the tool name: calls that send, create, update or delete are writes, everything else is a read.

Step by step

1. Open a run from Run Control

   On the Run screen, click any entry in Recent runs to open its trace: type, status, duration, cost, any error and, for trigger runs, each attempt. ClickOpen history to go to the worker's full history.

2. Read a Sequential Agent run in Run History

   On an agent, open Run History. Filter with the status chips (All,Completed, Failed, Running, Queued), the Source dropdown (User, API, Public Link, Slack, Webhook, Scheduled, Table Trigger, AI Employee), the Range dropdown (last 7, 30 or 90 days) and the search box, which matches run id, task and error text. Clear filters resets them. Owners and admins can switch between Me and Admin to see everyone's runs; other members see their own.

   Select a run to see its header (STARTED, ENDED,DURATION, COST, MODEL, SOURCE) and the agent configuration version it ran on. Below come Input Data, Task Outputs (one block per task), Final Output, any Error andTool Calls, where writes carry a WRITE tag. Copy any block as JSON or Markdown. Export downloads the run as a PDF report, and Re-run opens the run form with the same inputs filled in.

3. Follow a team session live

   In a team chat, the header counts MSGS, TOKENS, COSTand LATENCY for the session. The Live audit trail panel streams each event as it happens (which sub-agent started, which tool it called, handoffs between sub-agents) with running totals of events, tools, tokens and latency. The download button saves the trail. Sessions opened later from Run show a Conversation tab and an Audit trail tab.

   

4. Check an AI Employee's tasks

   In an employee's chat, the right panel has two tabs: Tasks (filter by All, Active, Completed, Failed) and Audit Trail. Open a task to see its plan, each step, the result and the tool calls behind it. The Activity button at the top of the page shows changes made to the employee itself.

   

5. Review policy evaluations

   Go to Compliance and choose Audit Trail (Policy evaluations). Every time a policy was checked against a tool call, a row is written here. Filter by result:All, Allowed, Denied, Alerted,Approval pending, Approval approved, Approval deniedand Logged. Expand a row to read its Evaluation context: the tool, the worker, the rule that matched and why. Rows appear automatically when workers run against active policies.

   app.turtleaicoworker.com/compliance

   

6. See who changed what

   Choose Admin Activity (Who changed what). The Governance view lists changes to policies, circuit breakers, PII settings, approvals, retention and exports, filterable with the chips All, Policies, Breakers, PII,Approvals, Retention and Exports. Each row shows the time, the event type, a plain summary, the person, the workspace and the IP address it came from.All activity shows every action by every user (creates, edits, deletes, invites, connects) and filters by module: Agents, Teams, AI Employees, Tables, Knowledge, Tools, Interfaces, Users & Org and Compliance.

   app.turtleaicoworker.com/compliance

   

7. Export an audit report

   Click Export audit report at the top right of the Compliance screen. Choose aFrom and To date, or leave both blank for the full history, and clickGenerate report. The report covers the selected workspace: its policies and their versions, evaluation counts, circuit breaker events, approval decisions, the PII configuration and the result of checking the audit chain. The export itself is logged as a governance event.

   

Reference

Run log

Tool call record

Governance event

Related

• Running work (Run Control): start runs and open recent traces.
• Approvals & human-in-the-loop: decisions that appear in the trail.
• Policies, budgets & guard rails: the rules evaluations are made against.
• Analytics: totals and trends built from the same records.