Skip to content
AgentsFence

Logs and audit

Location Evidence How to view
<profile>/agentsfence/audit.jsonl (0600) Policy changes, every decision, approvals, errors and test runs agentsfence audit, /fence audit, Desktop pane
<root>/agentsfence/audit.jsonl Install, protect, unprotect, settings, uninstall and rollback events agentsfence audit --profile default
Hermes agent.log / errors.log agentsfence.* log lines, session IDs and compile timing hermes logs, hermes logs errors
stderr (opt-in) JSON log messages AGENTSFENCE_LOG=debug|info|warning
Terminal window
agentsfence audit --profile work --session SESSION_ID -n 50
agentsfence audit --profile work --exclude-tests
/fence audit
hermes logs --session SESSION_ID
hermes logs | grep agentsfence

Events include policy_compiled, policy_amended, policy_expired, policy_missing, policy_dropped, decision, approval_granted, approval_denied, approval_orphan, amend_restricted, instruction_conflict, subagent_bound, error, installed, protected, unprotected, settings_changed, uninstalled, test_run, rolled_back and failed. Compile events include model, duration, attempts and fallback; decisions include capability, risk, rule and reason; approvals include choice and wait time.

Free-text argument values and compiler summaries are redacted or hashed. Audit records hash requests rather than storing a separate full-request field, but compile/amend events retain interpretation statements and selected instruction quotes, which can include a whole short request. Leaf destinations (recipients, URLs, paths and actions) are retained under configured redaction rules, with length bounds. Audit timestamps are UTC; CLI/Desktop display local time with the zone.

Policy files have separate retention: with persistence enabled, their unresolved queue saves full owner instructions after quoted material is stripped until a successful latest compile covers them. Failed or superseded updates survive restarts. Clearing that queue or deleting a policy does not delete retained audit quotes. See Data handling.

Logs rotate by size (audit.max_bytes, default 10 MB). Rotated logs expire after audit.retention_days (default 90); agentsfence settings --audit-retention-days 30 changes retention. Audit includes test sessions by default; --exclude-tests omits them and --only-tests shows only tests. Retained rotated files can be read directly as JSONL.