Skip to main content

Monitor drift and runtime

After launch, the Monitor tab answers one question: has anything changed that affects live policy? Each change is a drift event — a discrete, reviewable record. This page covers drift events, auth/audit/M2M logs, and SDK logging.

Prerequisites
  • Application launched (drift events only accumulate after launch)

Drift events​

EventFired whenWhy you care
scope_deletedA scope referenced by live policy was removedTools mapped to it silently became uncallable
tool_unmappedA mapped tool lost its mappingThat tool now denies everyone
default_role_disabledThe default access policy was switched offNew users stop getting access
default_role_changedThe default role was swappedNew users get different permissions than before
secret_rotatedThe introspection secret was rotatedOld SDK deployments will start failing introspection

Each row shows what changed, who changed it, and when. Dismiss marks an event acknowledged (bookkeeping — the record is kept).

Drift events only accumulate after launch — pre-launch changes are just setup housekeeping.

Workspace-wide logs​

The sidebar's MONITOR section complements the per-application tab:

PageWhat it shows
Auth LogsLogins, consent grants, token issuance
Audit LogsAdministrative changes (role edits, scope changes, launches)
M2M LogsMachine-to-machine token activity per service account

Runtime visibility from the SDK​

Until the runtime metrics endpoints ship (see roadmap below), your SDK's structured logging is the best signal. Wire it into your observability stack:

Python:

import logging
logging.basicConfig(level=logging.INFO, format="%(message)s")
# The SDK logs token validation, authorization decisions, policy
# refreshes, and manifest publish results.

Go:

cfg := authsec.Config{
    // ...
    Logger: slog.New(slog.NewJSONHandler(os.Stdout, nil)),
}

The SDK emits structured events for every token validation, every authorization decision (allow/deny with reason), every policy refresh, and manifest publish results. Any JSON-capable backend (Datadog, Honeycomb, Grafana Loki) can build dashboards on top. A good starting set:

  • Authorization denials by tool_name and reason (401 vs 403)
  • Token validation latency p50/p95
  • Policy refresh failures

Roadmap​

Marked as coming, not built:

  • Metrics endpoint — request totals, denial rates, error breakdown
  • Access-logs endpoint — per-request audit trail (who called what when)
  • Real-time event stream — WebSocket/SSE feed for the Monitor tab

← Clients and connections · → Connect agents and services