# Reviewing Agentic Activity

The SailPoint Agent Fabric Activity Center provides visibility into AI-related activity within your organization. It covers two classes of activity:

- **Prompts** reports show what users are doing with AI, including prompts submitted, files uploaded or downloaded, content pasted, and AI application browsing and sign-in. Refer to [Managing Prompt Security](policy_center/saf_prompt_security.md) for more information about prompt security, including setup instructions.
- **MCP and Tool Calls** reports show what agents are doing, either on behalf of users or autonomously, including tool invocations, API calls and queries against target systems, resources touched, and responses returned.

The Activity Center shows data captured from multiple sources, including the SailPoint Browser Agent Security browser extension, AI Plugin, API Connector, and MCP Gateway, with each source contributing to the data that it can observe. Its purpose is to show administrators what happened, who or what did it, and whether it was risky to aid in investigations.

## Viewing the Activity Center

**To view the Activity Center:**

1. Go to **Agentic Fabric**.

2. From the navigation menu, select **Activity Center**.

The widgets at the top of the page provide an overview of Prompts Scanned, Prompts Redacted, Tool Calls Observed, and Tool Calls Blocked.

The table at the bottom of the page shows details of either the **Prompts** or **MCP and Tool Calls** observed.

!!! tip
    Select any row in the table to see a side panel overlay with details of the selected prompt or tool call. Information that is truncated in the table appears in full in the overlay.
  
Select **Prompt** to review the following information about AI prompts users have submitted in your organization:

- **Timestamp:** The time and date the prompt was submitted.
- **User:** The email address of the user who submitted the prompt.
- **Source:** The browser extension or AI Plugin used to submit the prompt.
- **AI Client:** The AI client receiving the prompt.
- **Origin:** Where the prompt originated (for example, on an endpoint device).
- **Policy Decision:** Whether the prompt was allowed, redacted, or blocked.
- **Severity:** Whether the prompt was classified as critical, high, medium, or low risk based on the content of the prompt.
- **Sub-Category:** What type of information (such as specific credentials, PHI, or PII) contributed to the severity level.
- **Prompt:** The text of the prompt.
- **Details:** More information about how the prompt received its severity level, if available.

Use the quick filters above the Prompts registry to search for a specific user, AI client, or origin, or to filter by policy decision (Allowed, Redacted, Blocked), time period (Last 7 days, Last 30 days, Last 90 days, Last 180 days), or severity (Critical, High, Medium, Low).

Select **MCP and Tool Calls** to review the following information about each tool call:

- **Timestamp:** The date and time the call occurred.
- **User:** The email address of the user associated with the call.
- **Source:** The browser extension or AI Plugin used to make the call.
- **AI Client:** The AI client receiving the call.
- **Origin:** Where the call originated (for example, on an endpoint device).
- **Policy Decision:** Whether the call was allowed, redacted, blocked, or warned.
- **Connected Service:** The requested resource.
- **Tool Family:** The general type of tool (Write, Search, Read, Unknown, Sub-Agent, File, MCP, Web, Find, Terminal).
- **Tool Name:** The name of the tool used to make the call.
- **Hostname:** The hostname of the device running the tool.
- **IP:** The IP address of the device running the tool.

Use the quick filters above the MCP and Tool Calls registry to search for a specific user, AI client, tool, or server, or to filter by policy decision (Allowed, Redacted, Blocked, Warned), call status (Completed, Failed), tool family (Write, Search, Read, Unknown, Sub-Agent, File, MCP, Web, Find, Terminal), or time period (Last 7 days, Last 30 days, Last 90 days, Last 180 days).

Reviewing Agentic Activity

The SailPoint Agent Fabric Activity Center provides visibility into AI-related activity within your organization. It covers two classes of activity:

Prompts reports show what users are doing with AI, including prompts submitted, files uploaded or downloaded, content pasted, and AI application browsing and sign-in. Refer to Managing Prompt Security for more information about prompt security, including setup instructions.
MCP and Tool Calls reports show what agents are doing, either on behalf of users or autonomously, including tool invocations, API calls and queries against target systems, resources touched, and responses returned.

The Activity Center shows data captured from multiple sources, including the SailPoint Browser Agent Security browser extension, AI Plugin, API Connector, and MCP Gateway, with each source contributing to the data that it can observe. Its purpose is to show administrators what happened, who or what did it, and whether it was risky to aid in investigations.

Viewing the Activity Center

To view the Activity Center:

Go to Agentic Fabric.
From the navigation menu, select Activity Center.

The widgets at the top of the page provide an overview of Prompts Scanned, Prompts Redacted, Tool Calls Observed, and Tool Calls Blocked.

The table at the bottom of the page shows details of either the Prompts or MCP and Tool Calls observed.

Tip

Select any row in the table to see a side panel overlay with details of the selected prompt or tool call. Information that is truncated in the table appears in full in the overlay.

Select Prompt to review the following information about AI prompts users have submitted in your organization:

Timestamp: The time and date the prompt was submitted.
User: The email address of the user who submitted the prompt.
Source: The browser extension or AI Plugin used to submit the prompt.
AI Client: The AI client receiving the prompt.
Origin: Where the prompt originated (for example, on an endpoint device).
Policy Decision: Whether the prompt was allowed, redacted, or blocked.
Severity: Whether the prompt was classified as critical, high, medium, or low risk based on the content of the prompt.
Sub-Category: What type of information (such as specific credentials, PHI, or PII) contributed to the severity level.
Prompt: The text of the prompt.
Details: More information about how the prompt received its severity level, if available.

Use the quick filters above the Prompts registry to search for a specific user, AI client, or origin, or to filter by policy decision (Allowed, Redacted, Blocked), time period (Last 7 days, Last 30 days, Last 90 days, Last 180 days), or severity (Critical, High, Medium, Low).

Select MCP and Tool Calls to review the following information about each tool call:

Timestamp: The date and time the call occurred.
User: The email address of the user associated with the call.
Source: The browser extension or AI Plugin used to make the call.
AI Client: The AI client receiving the call.
Origin: Where the call originated (for example, on an endpoint device).
Policy Decision: Whether the call was allowed, redacted, blocked, or warned.
Connected Service: The requested resource.
Tool Family: The general type of tool (Write, Search, Read, Unknown, Sub-Agent, File, MCP, Web, Find, Terminal).
Tool Name: The name of the tool used to make the call.
Hostname: The hostname of the device running the tool.
IP: The IP address of the device running the tool.

Use the quick filters above the MCP and Tool Calls registry to search for a specific user, AI client, tool, or server, or to filter by policy decision (Allowed, Redacted, Blocked, Warned), call status (Completed, Failed), tool family (Write, Search, Read, Unknown, Sub-Agent, File, MCP, Web, Find, Terminal), or time period (Last 7 days, Last 30 days, Last 90 days, Last 180 days).

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.