Edge Trace schema
The record format agentic-auth drift record writes and drift check reads. Every model here
is closed (extra="forbid") and, by design, has no field anywhere that could carry a token,
header, credential, query string, or payload — the absence of those fields is itself the
guarantee that a committed trace is safe to check into a repo or attach to a PR.
EdgeEvent (one line of the raw JSONL events file)
| Field | Type | Notes |
|---|---|---|
v | 1 | Format version |
ts | datetime | |
source | "sidecar" | "sdk" | Which enforcement point recorded it |
acting_agent | str | null | The verified acting agent — never the unverified caller |
target | str | null | mcp://... or agent://... |
kind | "tool" | "delegation" | null | Must match target's scheme |
outcome | "allow" | "deny" | "observed" | "blocked_infra" | "blocked_local" | |
reason | str | null | Deny reason, when applicable |
DriftReport (output of drift check)
| Field | Notes |
|---|---|
result | "pass" | "drift" | "error" |
summary | edges_observed, unattributed_calls |
undeclared | List of edges observed but not declared, each with a verdict |
Verdicts: UNDECLARED_TOOL, UNDECLARED_DELEGATION, UNKNOWN_AGENT — the same three
outcomes the how-to guide's Configure the CI drift check
walks through wiring into a PR.
Why acting_agent, never caller
At hop 1 the request's caller might be user:alice, but the agent actually acting is
whoever holds the root grant. Recording caller would put an edge like
user:alice → agent://orchestrator into the trace — one no manifest could ever declare. The
recorder always uses the PDP's verified answer for who's acting; an event with no verified
acting agent is counted as unattributed rather than guessed.