Skip to main content
Erstan keeps a tamper-evident record of what agents and people do in your workspace, plus a running view of token usage and estimated cost. Workspace Audit and Analytics require the appropriate admin access. Members can review their own usage through My usage in the profile menu.
The Audit and Analytics pages require the admin permission. If you open them without it, Erstan shows an “Admin access required” message instead of data.

​
The audit log

The Audit page (available from the profile menu) is the workspace’s system of record. It shows every significant event across runs, tools, connectors, approvals, and sign-ins, with filters, a per-event detail drawer, and CSV export. A summary strip at the top totals the selected time range: Runs, Tool events, Queue jobs, Approvals, Tokens, and Integrations. Use the range selector (24h / 7d / 30d / 90d) to scope everything on the page.

​
What is recorded

The log is organized into tabs, each a different class of event:
The Approvals tab is a hash-chained ledger — each entry carries a sequence number, its own hash, and the previous hash. Erstan marks a row Verified or Broken so you can confirm the approval history has not been altered.

​
Reading and filtering

For email delivery, open External events and select the Email surface. This shows receipt and routing evidence; it is not the App’s processing queue. Where the event retains an Inbox reference, View message opens the shared message reader. Message access is checked separately: Audit permission alone does not grant access to another person’s private mail. Related runs also apply their own permissions. An empty result can mean that no matching delivery evidence is retained for the selected workspace, period or filters. It does not prove the Inbox contains no mail. Read permitted messages through an Inbox Data Source or the Inbox read tools. If an original email has expired under retention, an App may still hold its separately retained invoice File and processing records.
1

Open Audit

Choose Audit from the profile menu. Pick the tab for the event class you want and set the time range.
2

Narrow the results

Filter by search text, workspace, user, agent, integration, tool, status, or event type. On the Tools tab you can show errors only. Active filters appear as chips you can remove individually, or use Clear to reset.
3

Open an event

Select any row to open the detail drawer. It shows the full event payload, and for tool events the call, result, and any NetSuite queue job; for approvals it shows the ledger chain.
4

Jump to the run

When an event belongs to a run, use Open run in the drawer to go straight to that run’s step-by-step trace.
5

Export

Use Download CSV to export the current tab and filters for offline review or sharing.
This is the same trail you reach from a single run via Audit in Erstan on the run history and traces page — the run links into the audit log, and the audit log links back to the run.
The audit log records write actions to NetSuite and other systems regardless of how they were approved — including writes that were auto-approved. Review the Approvals and Tools tabs periodically so auto-approve never becomes a blind spot. See Security & write safety.

​
Usage and cost

For included allowances, Credit charges, purchases and refresh dates, see Credits and usage. Manage invoices, payment methods and cancellation through Subscription management. Request and concurrency limits are explained separately in Rate limits. Open My usage in the profile menu for your own usage, or Settings → Usage for the available account and workspace controls. Owners and admins can also investigate individual runs and aggregate activity in the following views.

Audit → Usage

Per-run token usage with a model breakdown, input/output/total tokens, tool-call counts, and runtime — filterable by agent, user, and range.

Agent analytics

A workspace overview of feedback, positive rate, total tokens, and estimated cost in USD, with top agents and recent feedback.

​
Agent analytics

The Analytics view (available from the profile menu with the required admin access) summarizes chat-agent activity over a 7-day, 30-day, or 90-day range, optionally filtered to a single agent. It shows four cards:
  • Feedback — total thumbs up and down collected on agent replies.
  • Positive Rate — thumbs up as a share of all feedback.
  • Tokens — total tokens, split into input and output.
  • Estimated Cost — an estimate in USD across the usage events in range.
Pick a single agent to also see its Recent Feedback (with the rated response and a link to open the execution or thread), and review Top Agents by feedback volume for the whole workspace.
Cost figures are estimates derived from token usage and model pricing, not a billing invoice. Treat them as a directional guide for spotting heavy agents, not an accounting source.

​
Team content footprint

Token usage and cost live in the two surfaces above. For a team’s storage footprint, open the team’s Settings and find the Workspace usage section: it lists the team’s Documents, Files, and Storage used — handy for spotting a team that is accumulating large attachments. This is a content count, not a token-cost figure. See Managing a team.

​
Good practices

Scan the Approvals and Tools tabs on a cadence (weekly is a reasonable start). Confirm approval rows read Verified, and look for write actions that ran without an explicit approval.
Sort the Usage tab by tokens, or use Top Agents in analytics, to find agents consuming far more than expected — often a sign of an over-broad prompt or a loop.
Filter Integrations and Logins by failed outcomes to catch expiring NetSuite authorizations or unexpected sign-in attempts before they disrupt agents.
Download a CSV of the relevant tab before a major workspace change so you keep a point-in-time record.

​
Next steps

Run history & traces

Read a single run’s step-by-step trace and open it in the audit log.

Security & write safety

How approvals, write policy, and per-user authorization keep you in control.

Approving AI actions

Review write actions before they run, and when to auto-approve.

Workspaces and people

Manage the members whose activity appears in the audit log.