ArmorPay Observability

ArmorPay agents run in SDK mode - they call the ArmorIQ backend directly through @armoriq/sdk or armoriq-sdk rather than sitting behind the MCP proxy (see Concepts and Getting Started). That SDK client is a standard observability producer, so ArmorPay activity follows the same path documented in the observability overview: one captured plan becomes one trace, and policy checks and tool calls become child spans.

What a trace looks like

Session (agentId: "ap-agent")
└── Trace (iap.plan)
    ├── policy_call span
    │   ├── decision: allow | hold | deny
    │   ├── enforcementAction: allow_log | hold | block
    │   ├── matchedRuleId, reason
    │   └── delegationId (when held)
    └── span (tool call)
        ├── toolName: create_invoice, record_payment, ...
        ├── toolInput / toolOutput
        └── errorMessage (on failure)

The policy_call span's enforcementAction is the same value your ArmorPay policy resolved (see Concepts) - a threshold breach that resulted in hold shows up as decision: hold with a delegationId you can follow to the plan view.

By default the trace's product attribute is armoriq-sdk, the same value used by any direct-client SDK integration. There is no separate armorpay producer identity.

Holds and delegation

When invokeWithPolicy opens a delegation (an amount, velocity, or recipient rule resolved to hold), the SDK recorder marks that span denied until a decision is made. Follow the delegationId in the span attributes to the plan detail view to see who approved or rejected it. See Getting Started for the client-side polling options (waitForApproval, holdPollIntervalMs, holdPollAttempts).

Freshness

Same defaults as every SDK producer: traces flush roughly every 5 seconds, and the dashboard polls every 30 seconds. See Freshness and retention for the full picture.

Enabling or disabling

Observability is on by default for any SDK client configured with an API key. To turn it off for an ArmorPay integration, pass the observability option through when constructing the client:

const client = new ArmorIQClient({
  apiKey: process.env.ARMORIQ_API_KEY!,
  userId: 'ap-service',
  agentId: 'ap-agent',
  observability: { enabled: false },
});

Disabling telemetry never changes an enforcement decision - it only stops the trace from being recorded.

Privacy boundary

ArmorPay tool inputs and outputs can include vendor names, invoice amounts, and (for Payroll) employee identifiers. The shared SDK recorders do not automatically redact this content - see Sensitive content. Avoid passing raw bank account numbers or full SSNs as tool parameters where you can use a reference ID instead, and restrict dashboard access to the org members who need it.

Next steps