Skip to content
ELEMENT 31

Glossary: run record

A run record is what each run of an agent on Czar leaves behind: what went in, what each step did, whether policy allowed it, and who approved. It stays on the appliance.

· 2 min read

IN SHORT

A run record is the trail each run of an agent leaves on the Czar appliance. It holds what went in, what each step did, whether policy allowed it, and who approved when a person had to. Inputs, draft, decision, and call are kept as one sequence. The record stays on the appliance and is something an auditor can read without help.

A run record is the trail that each run of an agent leaves on the Czar appliance: what went in, what each step did, whether policy allowed it, and who approved when a person had to, kept as one sequence that someone can open tomorrow.

Why it matters

A desk that adopts an agent is asked, sooner or later, to explain a particular outcome. The run record is the answer. It shows the packet that arrived, the passages the agent read, the draft it produced, the reviewer who decided, and the call that was made or not made. Nobody has to reconstruct the run from memory or from the logs of several systems.

Because the record is on the appliance, answering that question does not require sending anything to a vendor. The site opens its own record on its own hardware. That is what makes it something an auditor can read.

How it works here

A run begins when a packet reaches the agent's stable address. From that moment, each step is written as it happens: what the agent read and from where, what it drafted, whether the version's bounds allowed the step, and, at the step that waits, which reviewer saw the draft and whether they approved or stopped. If an allowed call is made, the record holds what was sent and to which tool.

The record names the version that produced the run, so the bounds that applied can be read beside what happened. A reviewer can follow a run live as it moves through the steps, or open a finished one later. The appliance also keeps the history around the runs: who published each version, who pointed each address, and who changed each role, each with a name against it.

  • Reviewer: the role whose decision the record holds at the waiting step.
  • Version: the frozen design each record names.
  • Bounds: the limits the record's policy checks are made against.

Questions this raises

Who can open a run record?
A reviewer can follow a live run or open a finished one. Who else may read records is decided by the site, within the roles the admin assigns. The record never leaves the appliance, so reading it means being permitted onto the appliance.
Does the record include the content of the draft?
Yes. The draft as the agent produced it, the passages it was built from, and any reads from connected systems are on the record, together with the reviewer's decision on them. The record is the actual sequence, not a summary of it.
Is the run record sent to Element 31?
No. Element 31 does not see the customer's runs. The record is written to and kept on the appliance in the customer's building, and on an air-gapped site there is no path for it to go anywhere else.

KEEP READING

Related.