> ## Documentation Index
> Fetch the complete documentation index at: https://docs.try-airlock.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Capture surfaces

> Agent runtime, push ingestion, and SaaS audit connectors.

Airlock's model is that **every agent act is the same fact**: an identity did
something, through a tool, at a time. Whether an agent fetched a memo inside
the sandbox, held a conversation, or concluded a decision a system will act
on, capture normalizes it into one envelope with three kinds:

| Kind       | Records                                                               | Arrives via                                                             |
| ---------- | --------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| `access`   | identity → resource: host, method, path, verdict, bytes, duration     | The sandbox proxy, shipped by [`airlock publish`](/cli#airlock-publish) |
| `chat`     | What the agent read, said, and did: prompts, replies, tool results    | Sandbox transcripts, shipped by `publish`                               |
| `decision` | What the agent concluded: target, decision, confidence, cited sources | The [push API](/decision-events), from agents anywhere                  |

Detection and the console read that one shape regardless of origin: one
chronological timeline instead of three tools with three logs.

## Identity first

No event enters the store anonymous. Every ingest token is bound server-side
to the account it was minted for, like a person's CLI login, or a named external
agent identity. See
[governance](/governance#identity-and-accounts) for accounts, tokens, and
revocation.

## Surface: the agent runtime

Airlock controls this end to end. `airlock claude`
runs the agent in a network-isolated container whose only exit is the repo's
egress proxy; your identity rides into both containers at start, so every
audit line is attributed at capture.

Two records come out of every session:

* **Transcripts** — prompts, replies, tool calls, and returned results: what
  the agent read and said.
* **Egress events** — every connection attempt, allowed or denied, with
  host, path, byte counts, and duration.

See [how it works](/how-it-works) for the containment mechanics and
[audit log](/audit-log) for exactly what ships.

## Surface: push ingestion

Agents that matter most often run *outside* any sandbox — resolution
pipelines, triage bots, schedulers. They report through the same ingest API
the CLI uses: an admin mints a named, scoped, revocable token per agent
identity, and the agent POSTs its events — most importantly
[decision events](/decision-events), the conclusions systems act on,
with evidence and confidence attached. Decision events are checked by the
[flagging rules](/exposure#decision-flags) in the same request that ingests
them.

The integration is one authenticated HTTP call; there is no SDK to adopt and
no runtime to embed.

## Surface: SaaS audit connectors

Humans do not work inside a sandbox — their access is captured from the
systems of record they already use. Audit connectors poll each platform's
admin/audit APIs on a schedule and write the same event shape:

| Connector           | Captures                                         |
| ------------------- | ------------------------------------------------ |
| **Confluence**      | Page views and content access from audit records |
| **Slack**           | Workspace audit events (metadata)                |
| **Notion**          | Workspace audit events                           |
| **Microsoft Teams** | Message export                                   |

Every connector declares its prerequisites up front. Required plan tier,
approval programs and realistic lead times, and credentials and scopes are all
stated before a connector enters a deployment plan.

## One stream, one record

Because every surface writes the same shape, the console's core view is one
chronological timeline per identity. The question *"what did this agent do, on
whose behalf, and what came of it"* is a consolidated filter.