Monitor drift and runtime

After launch, the Monitor tab answers one question: has anything changed that affects live policy? Each change is a drift event — a discrete, reviewable record. This page covers drift events, auth/audit/M2M logs, and SDK logging.

Prerequisites

• Application launched (drift events only accumulate after launch)

Drift events

Event	Fired when	Why you care
scope_deleted	A scope referenced by live policy was removed	Tools mapped to it silently became uncallable
tool_unmapped	A mapped tool lost its mapping	That tool now denies everyone
default_role_disabled	The default access policy was switched off	New users stop getting access
default_role_changed	The default role was swapped	New users get different permissions than before
secret_rotated	The introspection secret was rotated	Old SDK deployments will start failing introspection

Each row shows what changed, who changed it, and when. Dismiss marks an event acknowledged (bookkeeping — the record is kept).

Drift events only accumulate after launch — pre-launch changes are just setup housekeeping.

Workspace-wide logs

The sidebar's MONITOR section complements the per-application tab:

Page	What it shows
Auth Logs	Logins, consent grants, token issuance
Audit Logs	Administrative changes (role edits, scope changes, launches)
M2M Logs	Machine-to-machine token activity per service account

Runtime visibility from the SDK

Until the runtime metrics endpoints ship (see roadmap below), your SDK's structured logging is the best signal. Wire it into your observability stack:

Python:

import logging
logging.basicConfig(level=logging.INFO, format="%(message)s")
# The SDK logs token validation, authorization decisions, policy
# refreshes, and manifest publish results.

Go:

cfg := authsec.Config{
    // ...
    Logger: slog.New(slog.NewJSONHandler(os.Stdout, nil)),
}

The SDK emits structured events for every token validation, every authorization decision (allow/deny with reason), every policy refresh, and manifest publish results. Any JSON-capable backend (Datadog, Honeycomb, Grafana Loki) can build dashboards on top. A good starting set:

• Authorization denials by tool_name and reason (401 vs 403)
• Token validation latency p50/p95
• Policy refresh failures

Roadmap

Marked as coming, not built:

• Metrics endpoint — request totals, denial rates, error breakdown
• Access-logs endpoint — per-request audit trail (who called what when)
• Real-time event stream — WebSocket/SSE feed for the Monitor tab

Related

• Python SDK · Go SDK — logging configuration
• States and drift events reference

---

← Clients and connections · → Connect agents and services