Activity & audit log

Because an agent acts autonomously, Taskforce.sh records every tool call it makes. The activity log is your black-box recorder: it answers what did the agent do, when, and was it allowed?

Open an agent from the Agents tab and expand its panel to see the Activity section.

What's recorded

Each entry captures:

• Action — the tool that was called (e.g. retry_jobs, clean_queue).
• Outcome — allowed if the agent had permission and it ran, or denied if the permission check rejected it.
• Resource — the queue the action targeted.
• Details — action-specific context, such as the job ids affected, or the reason a call was denied.
• Timestamp — when it happened.

An allowed outcome means the permission check passed. It doesn't guarantee the action succeeded. If the call failed while running (for example, a job id that no longer exists), the entry is still allowed, with an error in its details.

Token lifecycle events are logged too: token.created and token.revoked.

Filter and paginate

The activity table can be filtered by outcome (allowed / denied), by action, and by date range, and is paginated for busy agents. Use it to answer questions like "has this agent ever been denied?" or "what did it do to the payments queue last night?"

The denied indicator

A repeated burst of denied actions is a useful security signal, it can mean a token is being used to attempt things it shouldn't (a leaked token, or a prompt-injection attempt steering the agent). When an agent has denied actions in the last 24 hours, its Activity panel shows a "N denied / 24h" badge.

Export

Export the activity log as CSV or JSON from the Activity panel, useful for record-keeping, incident review, or feeding into your own analysis. The export respects any filters you've applied.

TIP

Before letting an agent take write actions in production, give it a read-only token first and watch its Activity for a while. Once you're comfortable with what it's doing, switch to a full token scoped to the right role.