Reconstruct what happened
Where permitted telemetry exists, connect tool calls and application activity to an evidence trail. A network record by itself cannot reveal every prompt, tool decision or authority boundary.
- Observed actions and source citations
- Available ownership and permission context
- Explicit visibility gaps
