Scenario: Audit Trail

Every request through the gateway produces an execution record. See the table below for the full list of recorded fields.

Privacy note: The gateway records metadata about each request: provider, model, token counts, cost, attribution, and policy decision. The contents of prompts and AI responses are never recorded or stored by Axemere. Your data stays between your application and the AI provider.

What gets recorded

Field	Description
`record_id`	Unique identifier for this request
`org_id`	Your organization ID
`workload_id`	Workload that submitted the request
`project_id`	Project attribution
`action_type`	Action type (e.g. `ai.infer`, etc.)
`provider`	AI provider used (e.g. `openai`, `anthropic`, etc.)
`model`	Model name from the request
`credential_id`	Credential used to authenticate to the provider
`api_key_id`	Managed gateway API key; absent for self-hosted gateway records
`node_id`	Gateway node that handled the request
`decision`	`allow`, `deny`, `rate_limit`, `quarantine`, or `require_approval`
`decision_reason`	Plain-text explanation from the policy engine
`input_tokens`	Input tokens consumed; absent for denied requests
`output_tokens`	Output tokens produced; absent for denied requests
`cost_usd`	Estimated cost based on token usage; absent if unknown
`request_bytes`	Raw bytes sent to the provider
`response_bytes`	Raw bytes received from the provider
`record_tier`	`verified` (full inspection) or `observed` (cert-pinned, passthrough only)
`record_hash_hex`	SHA-256 hash of the record; required for cryptographic verification
`stream_outcome`	For streaming requests: `complete`, `client_disconnected`, `provider_error`, etc.
`stream_error`	Populated when `stream_outcome` is `provider_error`
`connection_type`	How the request reached the gateway: `direct_api`, `sdk_redirect`, or `connect_proxy`
`traffic_class`	`developer` (deliberate SDK/CLI/proxy config) or `ambient` (background app traffic via install or PAC file)
`labels`	Custom attribution labels applied at request time
`created_at`	UTC timestamp of the request

Verified vs. Observed: A verified record means the gateway performed full TLS inspection and has accurate token counts and cost. An observed record means the provider used certificate pinning; the gateway routed the traffic without inspection, so token counts and cost are estimates only.

Querying the audit trail in the console

Go to Records in the left nav. Use the filter controls to narrow by:

Workload, project, or API key
Date range
Decision (allow, deny, rate_limit, etc.)
Model or provider
Record tier (verified / observed)
Attribution label key/value

Click any record to see the full detail: attribution labels, policy decision, token counts, byte counts, cost, and the cryptographic hash.

Exporting for auditors

From the Records page, click Export CSV in the top-right corner. The export respects all active filters; set your date range, workload, and decision filter before exporting to scope the output to what auditors need.

The export includes all fields in the table above. Up to 50,000 records can be exported in a single request. For larger date ranges, narrow the filter scope and export in multiple batches.

Proving a specific request was denied

To confirm that a policy was enforced for a specific period:

Go to Records
Set the date range to the period in question
Set the Decision filter to deny
Optionally filter by workload or project to scope further

Each denied record includes the decision_reason field showing exactly which policy rule triggered the denial.

Cryptographic verification

Records with a record_hash_hex can be cryptographically verified to confirm they have not been tampered with. Use the Verify button on any record in the console, or see the Merkle Proofs guide for programmatic verification.

Data retention

Where records are stored depends on your deployment type:

Managed and Control Plane (CP)-connected self-hosted gateways: the CP stores a metadata record (hash, model, cost, policy decision, attribution) in a cloud-hosted database managed by Axemere. This is what the console and governance APIs surface.
Free Gateway: the gateway writes a full execution record (including request/response details) to your local PostgreSQL instance. Your local records are your responsibility; Axemere's systems do not have access to them.

A formal data retention policy with defined windows is in development. If you have specific compliance retention requirements, contact support.

Local Console: Records — filter and search records
Merkle Proofs guide — cryptographic verification
Budget Enforcement scenario — spend-based policy denial
Alert Channels guide — notifications for policy events