Trust & Governance Plane
OpenAI agent·gpt-4o
Connected
T3 · Admin APIAggregate·Sentry pulls usage and audit records from the vendor's admin API.
Conversations pulled from the vendor's admin API on a schedule. Depth is vendor-defined at this tier: usage, cost and audit records are complete; transcripts appear where the vendor exposes them, and are not real-time.
Tier 3 · Admin API · Aggregate. For full, real-time transcripts, route this agent inline through the Sentry gateway (Tier 1) or connect native telemetry (Tier 2) where the harness supports it.
Audit this week's agent vs human actions
Today, 07:30 · 3 steps
↘ 3,566 in · ↗ 2,380 out
Engineer
Give me this week's audit: which mutations were made by agents vs humans, and were any missing a human gate?
↘ in 46↗ out 0
Tool callAudit log (write)
→ requestQUERY actions WHERE ts >= week_start AND type = 'mutation'
← response412 mutations · 318 agent-initiated · 94 human · 2 agent mutations with no approval record
↘ in 120↗ out 2,100
Governance412 mutations this week: 318 agent-initiated, 94 human. 2 agent mutations are missing an approval record – both from the Cross-Domain Orchestrator during the Tuesday maintenance window. Each is forensically separable in the audit trail. Recommend review before sign-off.
↘ in 3,400↗ out 280
Can the Orchestrator auto-remediate during the change freeze?
Yesterday, 22:14 · 4 steps
↘ 2,810 in · ↗ 1,560 out
Engineer
The Cross-Domain Orchestrator wants to auto-remediate a degraded link now. We're in a change freeze – is it allowed?
↘ in 40↗ out 0
Tool callOPA policy
→ requestEVAL action=remediate, window=change-freeze, autonomy=L3
← responseDENY · L3 mutation inside a frozen change window requires human approval
↘ in 80↗ out 700
Tool callServiceNow approvals
→ requestCREATE approval req=remediate-link-AKL, approver=on-call-lead
← responsePending · routed to on-call network lead
↘ in 90↗ out 600
GovernanceBlocked. Policy denies an L3 mutation inside the change freeze, so I've human-gated it: an approval request is now pending with the on-call network lead. The Orchestrator will proceed only once that's granted, and the whole exchange is logged.
↘ in 2,600↗ out 260