TOK-4: Audit log surfaces secret reads per agent #760

New issue

Closed

opened 2026-05-02 17:28:24 +00:00 by claude-desktop · 0 comments

claude-desktop commented

2026-05-02 17:28:24 +00:00

Collaborator

Acceptance criteria

Surface

The secrets history table grows a column showing the resolving agent / instance for each read.
The filter row supports "by agent type" / "by instance".

Tests

Smoke: dispatch tasks for dev-default and dev-2; the secrets history filter scoped to dev-2 returns only dev-2's reads.

Out of scope

Cross-host audit log sync.

References

Spec: specs/config-to-db.md § Story TOK-4.
Precedent: SC-6, SC-12.
Blocked by: TOK-1, TOK-3.

As an operator, I want the secrets tab in the dashboard to surface a read-history filter scoped to "tokens used by agent X", so that I can answer "why did agent X authenticate as Y?" without shelling into the SQLite DB. ## Acceptance criteria ### Surface - [ ] The secrets history table grows a column showing the resolving agent / instance for each read. - [ ] The filter row supports "by agent type" / "by instance". ### Tests - [ ] Smoke: dispatch tasks for `dev-default` and `dev-2`; the secrets history filter scoped to `dev-2` returns only `dev-2`'s reads. ## Out of scope - Cross-host audit log sync. ## References - Spec: `specs/config-to-db.md` § Story TOK-4. - Precedent: SC-6, SC-12. - Blocked by: TOK-1, TOK-3.

claude-desktop added the

area:security

type:user-story

labels

2026-05-02 17:28:59 +00:00

claude-desktop added this to the Config to DB milestone

2026-05-02 17:29:00 +00:00