Skip to main content
Erstan keeps a tamper-evident record of what agents and people do in your workspace, plus a running view of token usage and estimated cost. Both surfaces are for Owners and admins — members do not see them.
The Audit and Analytics pages require the admin permission. If you open them without it, Erstan shows an “Admin access required” message instead of data.

​
The audit log

The Audit page (under Admin) is the workspace’s system of record. It shows every significant event across runs, tools, connectors, approvals, and sign-ins, with filters, a per-event detail drawer, and CSV export. A summary strip at the top totals the selected time range: Runs, Tool events, Queue jobs, Approvals, Tokens, and Integrations. Use the range selector (24h / 7d / 30d / 90d) to scope everything on the page.

​
What is recorded

The log is organized into tabs, each a different class of event:
The Approvals tab is a hash-chained ledger — each entry carries a sequence number, its own hash, and the previous hash. Erstan marks a row Verified or Broken so you can confirm the approval history has not been altered.

​
Reading and filtering

1

Open Audit

Go to Admin → Audit. Pick the tab for the event class you want and set the time range.
2

Narrow the results

Filter by search text, workspace, user, agent, integration, tool, status, or event type. On the Tools tab you can show errors only. Active filters appear as chips you can remove individually, or use Clear to reset.
3

Open an event

Select any row to open the detail drawer. It shows the full event payload, and for tool events the call, result, and any NetSuite queue job; for approvals it shows the ledger chain.
4

Jump to the run

When an event belongs to a run, use Open run in the drawer to go straight to that run’s step-by-step trace.
5

Export

Use Download CSV to export the current tab and filters for offline review or sharing.
This is the same trail you reach from a single run via Audit in Erstan on the run history and traces page — the run links into the audit log, and the audit log links back to the run.
The audit log records write actions to NetSuite and other systems regardless of how they were approved — including writes that were auto-approved. Review the Approvals and Tools tabs periodically so auto-approve never becomes a blind spot. See Security & write safety.

​
Usage and cost

You can see how much your agents are spending in two places.

Audit → Usage

Per-run token usage with a model breakdown, input/output/total tokens, tool-call counts, and runtime — filterable by agent, user, and range.

Agent analytics

A workspace overview of feedback, positive rate, total tokens, and estimated cost in USD, with top agents and recent feedback.

​
Agent analytics

The agent Analytics view (admin only, reached from the Agents area) summarizes chat-agent activity over a 7-day, 30-day, or 90-day range, optionally filtered to a single agent. It shows four cards:
  • Feedback — total thumbs up and down collected on agent replies.
  • Positive Rate — thumbs up as a share of all feedback.
  • Tokens — total tokens, split into input and output.
  • Estimated Cost — an estimate in USD across the usage events in range.
Pick a single agent to also see its Recent Feedback (with the rated response and a link to open the execution or thread), and review Top Agents by feedback volume for the whole workspace.
Cost figures are estimates derived from token usage and model pricing, not a billing invoice. Treat them as a directional guide for spotting heavy agents, not an accounting source.

​
Team content footprint

Token usage and cost live in the two surfaces above. For a team’s storage footprint, open the team’s Settings and find the Workspace usage section: it lists the team’s Documents, Files, and Storage used — handy for spotting a team that is accumulating large attachments. This is a content count, not a token-cost figure. See Managing a team.

​
Good practices

Scan the Approvals and Tools tabs on a cadence (weekly is a reasonable start). Confirm approval rows read Verified, and look for write actions that ran without an explicit approval.
Sort the Usage tab by tokens, or use Top Agents in analytics, to find agents consuming far more than expected — often a sign of an over-broad prompt or a loop.
Filter Integrations and Logins by failed outcomes to catch expiring NetSuite authorizations or unexpected sign-in attempts before they disrupt agents.
Download a CSV of the relevant tab before a major workspace change so you keep a point-in-time record.

​
Next steps

Run history & traces

Read a single run’s step-by-step trace and open it in the audit log.

Security & write safety

How approvals, write policy, and per-user authorization keep you in control.

Approving AI actions

Review write actions before they run, and when to auto-approve.

Workspaces and people

Manage the members whose activity appears in the audit log.