Safety & Monitoring

The agent safety model, unified audit trail, PHI access logging, retention policies, and compliance reporting.

This page covers the safety model, the audit trail, retention, and compliance reporting. The other pages in this section cover the rest of the monitoring and observability surface:

• Analytics & Observability - workspace analytics, call intelligence aggregates, recordings, review queue, dashboards, and the real-time event stream
• Insights - read-only SQL, schema discovery, and workspace health digests
• Metric Store - built-in and custom metric definitions, AI evaluation, and metric queries
• Call Trace Analysis - per-call emotional arcs, key decision moments, and coaching recommendations
• Voice Judge - audio-native quality scores across ten voice dimensions
• Production Evals - assertion and metric checks against live completed calls
• Simulation Coverage - systematic exploration of context graph state space
• Prompt Logs - full LLM inputs and outputs for auditing and debugging
• Trace Export - tool-call trace spans for external observability collectors

Safety Model

Safety evaluation is part of the agent's core reasoning. The agent assesses safety concerns as it converses and escalates to a human operator when warranted - either by forwarding the call or through an operator joining the conversation. Safety behavior is authored in the agent and its context graph (entry states, exit conditions, and escalation instructions); there is no separate monitoring configuration surface.

See Voice Agent for the call escalation flow and Operators for the operator join flow.

Unified Audit Trail

The Platform API maintains a unified audit trail across all services. Every significant action is recorded as an audit event with full context.

Audit Event Fields

Field	Description
service	Which platform component generated the event
actor_entity_id	Who performed the action
actor_credential_id	Which credential was used
action	What was done (e.g., entity.read, call.recording_access, session.create)
resource_type	Type of resource affected
resource_id	Specific resource affected
ip_address	Source IP
user_agent	Client user agent
phi_accessed	Whether this action accessed PHI

PHI Access Logging

Requests to PHI-sensitive endpoints are automatically detected and flagged. The platform recognizes patterns including entity reads, FHIR patient data, CRM contacts, call recordings, call intelligence, and audit reports themselves. PHI access events are tagged with phi_accessed: true for compliance reporting.

Audit logging is asynchronous and adds no latency to the request path.

Audit Query Endpoints

Four endpoints for compliance dashboards and investigation:

Endpoint	Description
GET /v1/{workspace_id}/audit	List audit events with filters: service, action, actor, resource type, resource ID, PHI-only, date range. Paginated.
GET /v1/{workspace_id}/audit/phi-access	PHI access report: who accessed what patient data, when, from where. Filterable by patient entity and date range. Required for HIPAA breach investigation (164.312(b)).
GET /v1/{workspace_id}/audit/entity/{entity_id}/access-log	All audit events for a specific resource.
GET /v1/{workspace_id}/audit/summary	Summary statistics: total events, PHI access events, unique actors, services with activity.

All endpoints require admin or owner permissions and are workspace-scoped.

Data Lineage

For entity-level data lineage - which sources contributed to an entity, where its data was synced, and its review history - see Entity Intelligence in the world model reference.

Retention Policies

GET /v1/{workspace_id}/settings/retention. Get the workspace retention policy. Returns HIPAA-compliant defaults (2190 days / 6 years) for any field not explicitly configured.

PUT /v1/{workspace_id}/settings/retention. Update the workspace retention policy (partial updates supported).

Field	Type	Default	Range	Description
call_recordings_days	integer	2190	365-36500	Call recording retention
call_transcripts_days	integer	2190	365-36500	Call transcript retention
audit_log_days	integer	2190	365-36500	Audit log retention
world_events_days	integer	2190	365-36500	World model event retention
phi_data_days	integer	2190	365-36500	PHI data retention
legal_hold	boolean	false	-	Override all retention (no deletion when enabled)
legal_hold_reason	string	null	-	Documentation for legal hold

The retention GET endpoint is available to any authenticated user; the PUT endpoint requires admin or owner. Retention changes are audit-logged.

Retention policies are currently advisory: the policy is stored and displayed but automated deletion is not yet enforced.

Audit Log Export

Endpoint	Description
POST /v1/{workspace_id}/audit/export	Create a new audit log export for a date range. Returns an export ID.
GET /v1/{workspace_id}/audit/exports	List all exports for the workspace with status and download URLs.

Exports are generated as NDJSON files and uploaded to secure cloud storage. Each export includes a time-limited download URL (12 hours). Capped at 50,000 events per export.

The export action itself is recorded as an audit event with PHI flag if the export contains PHI access data.

Returns 503 if export storage is not configured for the deployment.

Requires admin or owner permissions.

Compliance Reports

Three endpoints for auditor-facing reports:

Endpoint	Description
GET /v1/{workspace_id}/compliance/dashboard	Composite compliance health overview: HIPAA status, retention days, legal hold, active/total credential counts, last audit export.
GET /v1/{workspace_id}/compliance/hipaa	HIPAA evidence report: audit statistics, retention policy, encryption status, API key summary for a configurable period (1-365 days, default 90). Returns a compliance status assessment.
GET /v1/{workspace_id}/compliance/access-review	SOC 2 access review: all API key credentials with role, status, and activity dates for attestation.

All three require admin or owner permissions.

API Reference

• Audit
• Settings (retention)
• Compliance