One audit trail for every coding agent, and what it proves

WorkOS’s open-source audit harness adds centralized audit logging to coding agents including pi, Claude Code, Codex, and OpenClaw by capturing session, prompt, tool, and turn lifecycle events through shared plugins and sending them to a WorkOS organization. The system supports queries through an AuthKit-protected console, Audit Logs Export API, SIEM streaming, and MCP tools, while storing hashes and previews rather than complete prompts or tool content to limit sensitive data retention. To avoid placing powerful API keys on developer laptops, events are sent through an mTLS-protected Cloudflare Worker that validates device certificates, maps managed devices to users through an MDM, stamps trusted identity data, and uses a server-side secret for ingestion. The project addresses operational choices such as unknown devices, MDM outages, supported device-management systems, configuration rollout, and macOS-only certificate-based emission, but it emphasizes that laptop-generated events cannot conclusively prove an action occurred or that reporting was complete because users can fabricate or suppress events. Comparing audit activity with vendor billing data can identify sessions with no logs, while stronger integrity would require coding-agent vendors to generate server-side audit records or signed receipts for each model turn.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.