> ## Documentation Index
> Fetch the complete documentation index at: https://conductorone-jorge-mcp-resources-documentation.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit AI tool usage

> What C1 logs for AI tool calls, MCP resource reads, and AI system events, and where to find audit export options.

<Note>
  **Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
</Note>

Every tool call and resource read that flows through C1 MCP is logged. This page covers what's captured and how to export it for long-term retention, SIEM ingestion, or compliance reviews.

## What gets logged

Each tool call produces one audit log entry with:

| Field             | Example                                                                                                                  |
| :---------------- | :----------------------------------------------------------------------------------------------------------------------- |
| **Timestamp**     | `2026-05-07T14:23:11Z`                                                                                                   |
| **End user**      | The C1 user the AI client is bound to                                                                                    |
| **AI client**     | Client ID and display name                                                                                               |
| **MCP server**    | Registered server name                                                                                                   |
| **Tool**          | Tool name (for example, `github_create_issue`)                                                                           |
| **Result**        | Success / denied / error                                                                                                 |
| **Denial reason** | Populated when result = denied (for example, "tool not in user's access profile", "kill switch active", "client closed") |
| **Latency**       | Round-trip time for the call                                                                                             |

Each MCP resource read also produces an audit log entry. It includes the end user, AI client, MCP server, resource URI or URI template, result, denial reason when applicable, latency, and response byte count. C1 does not store resource content in the audit event.

In addition to tool call events, the following non-call events are also captured:

* Access request submitted / approved / denied
* Tool approved / disabled / classification changed
* MCP server registered / removed / auth changed
* AI client registered / state changed (active → hidden → closed → deleted)
* Kill switch flipped (tenant, server, tool, or client level)
* Tenant defaults changed

## Review AI agent conversations

The **Conversations** page under **AI** gives admins a read-only view of AI agent conversations across your organization. Conversations are organized into **Web**, **Slack**, and **System** tabs so you can review activity from all three surfaces in one place.

To access it, navigate to **AI > Conversations**. On the **Slack** tab, use the search bar to find conversations by title, then click any conversation to open a read-only transcript.

### System tab: agent policy step evaluations

When an approval policy step is assigned to an agent, each evaluation is attributed to the built-in **C1 System** agent identity and logged in the audit log as an AI-agent action. The evaluation is also recorded as a conversation under the **System** tab, so you can review the agent's reasoning and tool calls behind any policy decision. See [Assign for review](/product/admin/policies#assign-for-review) to configure an Agent step.

## Export the audit log

AI tool usage events are included in the C1 system log. To set up export to S3 or another data source for SIEM ingestion, see [System logs](/product/admin/system-log).