What a decision record carries
These are the fields returned by the API for each evaluation:
Request-level attribution is recorded alongside on the request record itself: the API key identity, agent, team, provider, requested model, token usage, cost, and upstream status and latency.
Decision outcomes
Outcomes in production are richer than allow and deny. A request can be denied by policy, held for human approval, rate limited, stopped at a budget limit, blocked by the prompt-injection scan, refused by model routing rules, or have its response content acted on by a PII policy (block, redact, or observe). An agent under the kill switch is refused outright. Each of these is a different answer to a different question, and the evidence record keeps them distinguishable rather than flattening them into a single allow/deny bit.Query decision evidence
policy_id, agent_id, or result (pass, fail). Results are also visible in the dashboard’s Eval Log.
Durable evidence rows are written today for content-policy evaluations on proxied responses and for all activity evaluated from OpenTelemetry ingest. Gateway enforcement denials return their decision and basis in the response; unifying those onto the same durable record is in progress. Check this page as coverage expands.

