Skip to main content

Decision Logs and Investigation

EnforceAuth ingests OPA decision logs so security and compliance teams can answer why was this denied? without SSH and grep across clusters.

Ingestion​

OPA/EOPA instances send decision logs to EnforceAuth using API keys. Configure ingestion endpoints in your entity settings.

Console investigation​

The Decisions page (/decisions) defaults to All entities. Scope is chosen on this page and is not carried over from Entity Management. Logs are tagged with the entity that owns the ingesting API key, which is often a system and sometimes the organization itself.

  • Organization returns logs for that org plus descendant systems. An organization with no descendant systems is an exact match on that org UUID. It is not an empty list, and it is not the tenant-wide list.
  • System is an exact match on that entity.
  • The list is empty only when nothing matches the selected scope.

Search accepts a decision UUID (decision_id) or a policy path. A non-UUID search is sent as path with a trailing * unless the text already includes a wildcard. The policy dropdown sends an exact path. Outcome (Allow, Deny, Error, Partial), time range, system ID (labels.id), and bundle revision combine with AND. System ID and bundle revision sit on a separate advanced-filters row. The URL is the source of truth (entity_id, outcome, path, decision_id, from, to, system_id, bundle_revision), so a copied link restores the same view. Entity detail View decisions opens /decisions?entity_id=<id>. Scroll to load the next cursor page.

The stats bar shows Total, Allow, Deny, Error, and Partial from the API totals for the filtered time range when total_count and outcome_counts are present. When a decision ID or path search comes back without those totals, the bar counts rows loaded so far and is labeled loaded results instead of the time window. Pause and Refresh now control the live refresh. Open a row for input, policy version, and the evaluation result.

Audit export​

Export decision evidence for SOC 2, HIPAA, and internal audits. See Audit evidence.

API​

List and fetch decisions via the REST API — API Reference.