Observability Dashboard
Use the overview, trace list, execution story, errors, and policy insights screens to move from organization health to the exact policy, tool, model, or error behind an agent operation.
This page is for developers, security teams, and operators who read traces in the ArmorIQ dashboard. You learn what each screen shows, how to find one trace, and how to read the data-quality signs. The dashboard helps you move from organization-level health to the exact policy, tool, model, or error span behind an agent operation.
Open Observability
Choose an organization, then open Observability in the dashboard navigation. The navigation has four entries:
| Entry | What it shows |
|---|---|
| Sessions | The overview and the list of recent sessions (/dashboard/observability) |
| Traces | A filterable list of traces (/dashboard/observability/traces) |
| Errors | Errors across your agents, for 24 hours, 7 days, or 30 days, with a product filter |
| Policy insights | Policy latency, matched rules, and the tools they affect, for 7 days |
Capture settings, quota, and alerts are on a separate page: Settings > Observability. See Organization controls.
Refresh and reporting periods
Every observability query polls over HTTP every 30 seconds. This is not streaming, so data can be up to one polling interval behind after it reaches the backend. Errors and Policy insights refresh every 5 minutes.
The Overview and the Traces list request a fixed 7-day period. The backend API accepts 1 to 90 days, but these screens have no time-range selector.
Traces per minute has different semantics from the other overview metrics:
- Traces per minute uses a trailing 60-minute window, bounded by the requested period.
- Sessions, traces, tokens, cost, latency, and errors use the full requested period, currently 7 days in the UI.
ArmorCodex and ArmorClaude complete turn telemetry at the end of a turn, so a session can look incomplete until the turn ends, the data is sent, and the next 30-second poll runs.
1. Overview and Sessions
Route: /dashboard/observability
Use this screen to answer whether agents are producing telemetry and which sessions were active most recently.
The overview shows:
| Metric | Meaning |
|---|---|
| Traces / min | Recent trace throughput over the trailing window |
| Sessions | Sessions active in the reporting period |
| Traces | Accepted traces in the reporting period |
| Tokens (in+out) | Input plus output tokens; the hint separates the two |
| Cost | The reported model cost |
| p50 latency | Median trace duration |
| p95 latency | 95th-percentile trace duration |
| Errors | Traces whose status is not ok |
The Sessions table has these columns: Session, Agent, Product, Started, Traces, Tokens, Cost, Task outcome, Technical status, and Last activity. You can filter it by service name and by instrumentation scope name. Select a row to open Session Detail.
The page also shows a Data collection summary with a link, Manage in organization settings. A session outside your plan's history shows Outside your plan's history.
Two actions are in the page header:
- Find execution story opens the lookup page. See Find one execution.
- Export traces starts an encrypted export of recent traces. It shows only if you may export and read content.
Current limitations:
- The overview requests the first 50 sessions.
- The backend returns cursor metadata, but the current screen has no Load more control.
- The page has loading, empty, and retryable error states.
2. Session Detail
Route: /dashboard/observability/sessions/:id
The header shows the session ID, the agent, the product, the input-plus-output token total, the cost, the duration, the task outcome and the technical status, the start time, and the last activity. The trace table below lists the session's traces. Select a trace to open Trace Detail.
3. Trace list
Route: /dashboard/observability/traces
Use the trace list to find slow, denied, or failing operations across sessions. The filters are:
- status: OK, Error, or Denied;
- a Has error toggle;
- search by trace name;
- service name (exact match) and instrumentation scope (exact match);
- minimum duration in milliseconds.
The table has these columns: Time, Name, Task outcome, Technical status, Latency, Tokens, Cost, Spans, Tags, and Session. The Spans cell can show degraded trace or an error count.
The list requests the first 100 traces from the last 7 days. It has no Load more control. When nothing matches, it says "No traces match" and suggests that you widen the time frame or clear the filters.
4. Trace Detail
Route: /dashboard/observability/traces/:id
The :id can be the ArmorIQ trace ID or the 32-character OpenTelemetry trace ID. The dashboard treats a 32-character hexadecimal value as the OpenTelemetry ID.
The header shows the trace name, the outcome, the source, the start time, and the duration. It also shows the Platform trace ID, the OpenTelemetry trace ID (with a copy button), the service, the scope, and a link to the session. A Technical tag appears only when the technical status adds information.
Three tabs show the same execution:
| Tab | What it shows |
|---|---|
| Execution | The outcome, cost, and timing source, then a timeline: Policy evaluation, Tool executions, Recorded execution errors, and the Intent plan with each plan item, its status, its retries, and its policy decision |
| Operations | Typed facts for approvals, delegations, unsuccessful operations, Bash and CLI work, MCP calls, and tool calls. Bash and CLI work shows executable names only. It never shows command text. |
| Span tree | The spans as a tree. Each row shows the name, status, category (Model, Policy, Approval, Delegation, Tool, MCP, Bash, CLI, Command, Plan, Error, or Event), duration, and redaction state. Select a span for its captured metadata. |
Policy denial and execution failure
The dashboard keeps these apart. A policy result is shown in Policy evaluation, with the policy ID, version, rule, action, reason code, and source. A denied result is marked with a lock. A failure while a tool ran is shown in Recorded execution errors, with the error type and exit code. The trace outcome shows Denied when policy denied the run. Plan state and technical status also stay apart from the task outcome: Completed, Partially completed, Denied, Failed, Abandoned, or Unknown.
Read the data-quality signs
A box named Execution data notice and a row of quality facts tell you how far to trust the view:
| Sign | Meaning |
|---|---|
| "This execution story is incomplete" | The trace is partial. A reason follows. See Incomplete traces. |
| "Showing X of Y plan items", "The span tree is limited to N captured spans" | The view is capped. The data is stored. |
| "Telemetry arrived late" | The data arrived more than one minute after the run ended |
| Source and Mapper | Where the trace came from, and the version of the mapper that read it |
| Sampling | The sampling state, and the rate when there is one |
| Redaction | How many spans are in each redaction state |
| Capture mode and Content status | The capture mode that applied, and whether content was stored |
| Pipeline health | delayed, partial, or on time |
| Rejected spans (trace-specific) | A count, or "not trace-attributed" when ArmorIQ cannot tie rejections to this trace |
Captured content
The Captured prompt and response panel shows content only if your organization captured it and you have the content read permission. It can show User prompt, Agent output, Tool arguments, Tool result, and Safe error summary. Each has a Copy button. When content is missing, a notice says why, for example "The organization capture mode is metadata; it did not store prompt or output content." See What data is captured. Without the permission, you see a Permission required page, and metadata still shows in the lists.
Find one execution
Route: /dashboard/observability/traces/find
Open Find execution story to look up an execution by one field at a time: Session ID, Conversation ID, Workflow run ID, Agent ID, Product, or RIS ticket ID. To look up by ArmorIQ trace ID or OpenTelemetry trace ID, open the trace directly from its ID.
Missing values and zero values
Optional values render as -- or Not reported when the data has no value. Timing that ArmorIQ cannot check shows as "client-reported" or "Legacy timing—not verified". Cost shows Not reported when it is missing, explicitly not reported, or a legacy zero.
Token and cost totals can still be zero in an aggregate when no model span reported usage. A zero can mean no model span, pricing not available, or a measured zero. Open the trace and check its model spans and token fields before you read the aggregate.
Next: understand every field, use the read API, or troubleshoot missing data.
Organization Controls
Set what ArmorIQ collects for your organization, limit it by product, start temporary debug capture, watch quota and pipeline health, and set alerts.
ArmorCodex and ArmorClaude Observability
Understand how ArmorCodex and ArmorClaude assemble, complete, and ship one trace per agent turn.