Actions

A protected action is the record of one tool call an agent made through the K-Block Gateway, or of one decision-only authorization it asked for: the call, the policy decision, any approval, the execution (or, for decision only, the authorization) and the receipt. The Actions page lists every protected action of the organization, and each action has a page that tells its whole story. See Actions for the concept.

Every role can open the list and every action. Only owners and admins can cancel an action.

The actions list

Each row shows:

The newest actions come first. The list loads 50 actions at a time; use the load-more control at the bottom for more.

Filters

• Status: one of the ten statuses (see Statuses), or All statuses.
• Agent: one agent, or All agents. The list offers the organization's first 100 agents.
• Clear filters resets both.

The dashboard offers only these two filters. The Cloud API can also filter by decision, environment and policy version, among others; see Cloud API.

Empty states

• With filters set and no match: "No actions match these filters".
• With no action at all: "No actions yet", with Set up an agent. Actions are recorded when an agent calls a protected tool through the Gateway, or asks K-Block to authorize a call of a decision-only tool (POST /v1/authorize), with its gateway API key.

The list does not refresh by itself. Reload the page to see new calls.

Statuses

Approved is used both for a call the policy allowed and for a call a person approved. The Decision column tells them apart. Full details: Action statuses.

The action page

The header shows the tool and action, the status (with an observe badge when an observe window applied), the agent, the amount, the environment and the time of the call.

Lifecycle

The lifecycle lists the steps in order:

1. Called: the agent called the tool.
2. Decided: allowed, denied or approval required by the policy. A call allowed only because an observe window was open is marked, with what the policy would have done.
3. Approval (when the policy required one): waiting for a person, approved and signed, rejected and signed, cancelled, or expired without a decision. It links to the request.
4. Executed: the upstream tool ran once, the call failed, it is running, it was not executed, or "Approved: runs once when the agent retries the same call". For a failure the Gateway detected itself, this step names the Gateway's code (for example RESULT_NOT_STORABLE or UPSTREAM_TIMEOUT) instead of calling it the upstream's error. For a decision-only tool this step is Authorized ("Authorized by K-Block and handed to the caller (decision only)…") or Authorization ("Not authorized yet", "Not authorized", or "Approved: authorized once when the caller asks again…"): it never says that K-Block executed the call.
5. Receipt: the signed receipt with its outcome (for a rejection or cancellation, the action's status), "Signed authorization receipt issued (it proves the authorization, not an execution)" for decision only, "No receipt for this outcome" (denied and expired actions), or "No receipt yet". Once the hosted evidence was deleted after the retention period, the step adds that the hosted copy was deleted and that a bundle downloaded before then stays verifiable, and the page shows the notice Hosted evidence deleted after the retention period.

How it ended

When an action ended other than by its decision, a notice under the lifecycle says how:

The notice shows the recorded detail and links to the receipt when there is one.

Why

The Why card explains the decision in one sentence: which rule or default decided, and the enforcement that applied. It says whether the explanation was recorded at decision time or recomputed on read. It can also show:

• a shadow line, when a shadow version would have decided differently (shadow versions are never enforced);
• The policy changed after this decision, when the deciding version is no longer active;
• Re-run as dry-run with today's policy, which opens Test and simulate with this action's call. Only the action's ID is put in the link;
• Roll back to vN…, for owners and admins, while the deciding version is still the active one and was activated less than 24 hours ago, and a version to roll back to exists. It opens the policy's rollback. See Activate, roll out and roll back.

Call and policy decision

• Call: the agent, the tool and its MCP server, the expiry, and the exact Arguments. Request identifiers holds the arguments digest, the request fingerprint, the idempotency key (when the agent sent one) and the last update time.
• Policy decision: the deciding rule (or "The policy default") with the policy name and version, the reason code with its explanation, and any error detail. Policy digest and recorded decision shows the policy digest, the rule definition and the recorded decision reason.

Receipt, approval, execution and delegation

Cards beside the decision show what followed, when it exists:

• Receipt: the outcome, when it was issued, the issuer and the receipt object, with Open and verify receipt. See Receipts.
• Approval: the status, when it was requested, decided and expires, how many approvers were listed and who decided, with Open approval request.
• Execution: the status, start and finish, the error, and the execution, result and upstream attestation objects. "No upstream attestation" means the upstream is not K-Block-aware. Upstream tool result shows the result the upstream returned.
• Delegation: the state, expiry and permissions of the delegation the Gateway acted under, with the issuer (principal), the delegate (Gateway) and the delegation object.

K-Block chain

The K-Block chain lists the signed objects of the action's thread (task, proposal, approval or rejection, execution, result and so on), content-addressed and parsed in your browser. Identities are labelled when the page knows them: "principal" for the organization principal, and "gateway" for the Gateway identity pinned in the dashboard (the one it trusts). When the dashboard has no pinned Gateway identity, the identity K-Block reports as its Gateway is labelled "gateway (not pinned)": compare its KID with the Gateway KID that K-Block gave you, and let K-Block support know that the dashboard shows this label. A note or reason signed into an approval or rejection is visible here, inside the signed object's JSON.

To verify every signature and the workflow, download the receipt and verify it. See Verify a receipt.

Cancel an action

An owner or admin can cancel an action whose status is Pending approval or Approved. A cancelled action can never be approved or executed. An action that is already Executing cannot be cancelled.

1. Check that you can sign

   A cancellation is signed by the organization principal, in your browser. The Cancel this action card appears for owners and admins on a cancellable action. If your account holds no copy of the principal's key in this browser, the card says "The organization principal's key is not available to you in this browser." and links to Settings. If this browser's key storage cannot be read, the card shows the error "This browser's key storage is not available, so the principal's key cannot be used here" instead: that does not mean you have no copy. Close other dashboard tabs and reload the page. If it stays, check that the browser lets this site store data: some private windows and privacy settings block it.

2. Cancel

   Optionally enter a Reason (optional), which is signed into the cancellation. Select Cancel action…, then Sign cancellation to confirm "Cancel this action permanently?".

3. Check the result

   The page reloads with the status Cancelled. A pending approval request is closed as cancelled, and a signed receipt of the cancellation is issued. When the agent retries the call, the Gateway answers that it was cancelled.

Cancellation uses a signed-in session only; API keys cannot cancel. If the cancellation is refused, the card shows "The cancellation was not recorded" with the reason, for example when the action started executing meanwhile.

Next steps