Document Datadog AI agent coverage in Audit Trail#38221
Open
anthony-dgx wants to merge 10 commits into
Open
Conversation
Clarify which Datadog AI agents and action types are currently tracked under Audit Trail's actor and delegation model, so customers can tell what @evt.actor.mode:* and @delegator.* queries do and don't cover today.
Bits Assistant actions through the chat panel are tracked, but actions through inline invocation (Cmd+I) are not yet tracked.
Swap the description: the full Bits Assistant page is tracked, the inline chat panel (Cmd+I) is not yet tracked.
Bits Dev doesn't take actions in Datadog, so it's out of scope for Audit Trail tracking.
Contributor
Note that third-party or customer-built agents can authenticate with API and application keys, personal access tokens, or service account tokens, none of which Audit Trail distinguishes from regular usage.
Lets customers know when the coverage table was last verified, since onboarding to the actor and delegation model is ongoing.
This comment has been minimized.
This comment has been minimized.
evazorro
requested changes
Jul 17, 2026
evazorro
left a comment
evazorro
left a comment
Contributor
There was a problem hiding this comment.
Thanks for contributing! I added a few suggestions for clarity, and a question.
Could you also update this PR with a title and description?
| ## Overview | ||
|
|
||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. This guide walks you through finding agent-driven events, filtering them by agent type, and tracing an agent's actions back to the user who delegated them. | ||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. |
Contributor
There was a problem hiding this comment.
It looks like you dropped "Bits Dev" from the list here; was that intentional? Bits Dev is still mentioned on this other page: https://github.com/DataDog/documentation/pull/38221/changes#diff-d522430ba4fafc9a364e7d797865cfcd58a9caca40f616e2bb9d2a254ce659fcR21
Contributor
Author
There was a problem hiding this comment.
Good catch! I removed it from the list because Bits Dev can't take action in Datadog today
Comment on lines
130
to
133
Contributor
There was a problem hiding this comment.
Suggested change
| - In the top-right of the navigation bar, click {{< ui >}}Ask Bits{{< /ui >}}. | |
| - In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon). | |
| - Press <kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd>. | |
| - In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}}. |
Adding periods to the end of each item to match line 129
| | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | ||
| | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | ||
| | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | | ||
| | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key or personal access token (PAT) and service account token (SAT) usage. | |
Contributor
There was a problem hiding this comment.
Suggested change
| | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular API and application key or personal access token (PAT) and service account token (SAT) usage. | | |
| | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular usage of API keys, application keys, personal access tokens (PATs), or service account tokens (SATs). | |
Restructured to make this easier to read
| | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | ||
| | Bits Security Analyst | Tracked | Actions run in `autonomous` mode. There is no delegating user, because these actions don't involve a human in the loop. | | ||
| | Bits Agent Builder | Not yet tracked | Actions don't include `@evt.actor.mode` or `@delegator.*` yet. | | ||
| | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | |
Contributor
There was a problem hiding this comment.
Suggested change
| | Actions taken through the Datadog MCP server | Tracked | See [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server). | | |
| | Actions taken through the Datadog MCP server | Tracked | See the [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server) section. | |
It's clearer (and better for AI chunking) to say that the link is to a section on the same page; I'll add a suggestion in a few other places too
| 2. In the search bar, enter the query: `@evt.actor.mode:*`. | ||
|
|
||
| This query returns every event where a Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). | ||
| This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). See [Agent coverage](#agent-coverage) for which agents and action types this includes. |
Contributor
There was a problem hiding this comment.
Suggested change
| This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted `interactive` (a user was present and approved the action) or `autonomous` (the agent acted on a system trigger, with no user involved). See [Agent coverage](#agent-coverage) for which agents and action types this includes. | |
| This query returns events where an onboarded Datadog AI agent is the actor, whether the agent acted in `interactive` mode (a user was present and approved the action) or `autonomous` mode (the agent acted on a system trigger, with no user involved). See the [Agent coverage](#agent-coverage) section for which agents and action types this includes. |
| 3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode. | ||
|
|
||
| **Note**: Rollout to all Bits agents is in progress, and coverage is not yet complete. Actions from agents that have not yet onboarded do not appear in `@evt.actor.mode:*` results. | ||
| **Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See [Agent coverage](#agent-coverage) for details. |
Contributor
There was a problem hiding this comment.
Suggested change
| **Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See [Agent coverage](#agent-coverage) for details. | |
| **Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See the [Agent coverage](#agent-coverage) section for details. |
| | All actions attributed to a user, including actions a Datadog AI agent performed on their behalf | `(@usr.id:<USER_ID> OR @delegator.id:<USER_ID>)` | | ||
| 3. See [Create a dashboard or a graph][2] if you want to put this information into a dashboard or graph. | ||
|
|
||
| **Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See [Agent coverage](#agent-coverage) for details. |
Contributor
There was a problem hiding this comment.
Suggested change
| **Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See [Agent coverage](#agent-coverage) for details. | |
| **Note**: This only surfaces delegated actions from agents and action types already onboarded to the delegation model. See the [Agent coverage](#agent-coverage) section for details. |
- Drop Bits Dev from the agent examples in events.md, matching its removal from the agentic usage guide (it doesn't take actions in Datadog) - Restructure the third-party/customer-built agents note for readability - Clarify section links (Agent coverage, MCP server) to say 'the ... section' instead of just linking the title - Add trailing periods to the Bits Chat web application bullet list
…rage' into adagneaux/audit-trail-agent-coverage
anthony-dgx
changed the title
Contributor
Author
|
/review |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🤖 Automated review by Claude. AI-generated; verify before acting.
Reviewed the Bits AI agent name updates (Bits Dev/Bits Assistant → Bits Chat) and the new Agent coverage section in the audit trail guide. Content is clear and factually consistent. A few minor style/consistency points inline.
Reviewed f384fccb5b32e92cc6942a641bd6f8f729b2adaf — workflow run
| | Agent | Status | Notes | | ||
| | ----- | ------ | ----- | | ||
| | Bits SRE | Tracked | Most actions include `@evt.actor.mode` and `@delegator.*`. Some tool-call and investigation actions do not include these fields yet. | | ||
| | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | |
Contributor
There was a problem hiding this comment.
Style: This keyboard shortcut is written differently than elsewhere in the docs (see content/en/bits_ai/bits_chat.md:132, which uses <kbd> tags and includes both Cmd and Ctrl). Windows/Linux users won't recognize Cmd+I. Consider matching the existing pattern:
Suggested change
| | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (Cmd+I) don't include these fields yet. | | |
| | Bits Chat | Partially tracked | Actions taken from the full [Bits Chat page][3] run in `interactive` mode, with the requesting user in `@delegator.*`. Actions taken from the inline chat panel (<kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd>) don't include these fields yet. | |
|
|
||
| Datadog AI agents onboard to the actor and delegation model individually, so coverage varies by agent and by action type. Use this table to check what you can query. | ||
|
|
||
| **As of July 17, 2026**, the following coverage applies: |
Contributor
There was a problem hiding this comment.
Suggestion: The explicit "As of July 17, 2026" anchors the table to a specific date and creates a maintenance burden — readers hitting this page months from now won't know if the table is still accurate. Consider either committing to a review cadence and noting it ("Coverage is reviewed monthly") or dropping the date and letting the table content speak for itself, since each row already describes the current state per agent.
| ## Overview | ||
|
|
||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Dev, Bits Assistant, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. This guide walks you through finding agent-driven events, filtering them by agent type, and tracing an agent's actions back to the user who delegated them. | ||
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. |
Contributor
There was a problem hiding this comment.
Style: "current" is a temporal marker that ages similarly to "currently" (avoided per the style guide). Since the new section is titled "Agent coverage," you can drop the qualifier:
Suggested change
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking current agent coverage. | |
| Datadog AI agents, including the Bits fleet (Bits SRE, Bits Chat, Bits Security Analyst) and Bits Agent Builder, can take actions inside your organization on their own or on behalf of a user. Audit Trail attributes these actions to the agent that performed them and, when applicable, to the user who authorized them. Onboarding to this attribution model varies by agent and by action type. This guide walks you through finding agent-driven events, filtering them by agent type, tracing an agent's actions back to the user who delegated them, and checking agent coverage. |
| 3. Click an event to open details and see the full actor breakdown: the delegator (the user, if any), the agent, and the mode. | ||
|
|
||
| **Note**: Rollout to all Bits agents is in progress, and coverage is not yet complete. Actions from agents that have not yet onboarded do not appear in `@evt.actor.mode:*` results. | ||
| **Note**: This query only returns activity from agents and action types already onboarded to the actor and delegation model. See the [Agent coverage](#agent-coverage) section for details. |
Contributor
There was a problem hiding this comment.
Suggestion: This note is largely redundant with the sentence added to step 2 (line 40), which already tells readers to see the Agent coverage section for which agents and action types are included. Consider removing this note to reduce noise, since the same information appears immediately above.
| | Actions taken through the Datadog MCP server | Tracked | See the [View actions taken through the Datadog MCP server](#view-actions-taken-through-the-datadog-mcp-server) section. | | ||
| | Third-party or customer-built agents | Not tracked | Audit Trail doesn't distinguish these from regular usage of API keys, application keys, personal access tokens (PATs), or service account tokens (SATs). | | ||
|
|
||
| **Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. |
Contributor
There was a problem hiding this comment.
Style: "action types haven't onboarded" reads awkwardly — action types are the thing being onboarded, not the actor. Passive voice fits better here:
Suggested change
| **Note**: Even for a tracked agent, some action types haven't onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. | |
| **Note**: Even for a tracked agent, some action types haven't been onboarded yet. `@evt.actor.mode:*` doesn't return every action for every tracked agent. Datadog is expanding coverage to the remaining agents and action types. |
| - In a Datadog product integrated with Bits Chat, click {{< ui >}}Ask Bits{{< /ui >}} or {{< img src="bits_ai/dev_agent/twinkling_stars_icon.png" inline="true" style="width:24px">}} (the twinkling stars icon) | ||
| - Press <kbd>Cmd</kbd>/<kbd>Ctrl</kbd> + <kbd>I</kbd> | ||
| - In the left-side navigation panel, click {{< ui >}}Bits AI{{< /ui >}} | ||
| - Go to [Bits Chat][11] directly. |
Contributor
There was a problem hiding this comment.
Suggestion: "directly" is a filler word here — the URL itself is the direct route. Consider tightening:
Suggested change
| - Go to [Bits Chat][11] directly. | |
| - Go to [Bits Chat][11]. |
evazorro
approved these changes
Jul 20, 2026
evazorro
left a comment
evazorro
left a comment
Contributor
There was a problem hiding this comment.
Thanks for making those changes! I would consider some of the /review suggestions, but otherwise looks good
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Adds an "Agent coverage" table to the audit trail agentic-usage guide, showing which Datadog AI agents (Bits SRE, Bits Chat, Bits Security Analyst, Bits Agent Builder) and other action types Audit Trail's actor and delegation model tracks today, and which it doesn't track yet. Also:
events.mdwith the coverage tablebits_chat.mdMerge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Used Claude Code throughout, including to query live Audit Trail data to verify agent coverage before writing the table.
Additional notes