Skip to main content
Attribution identifies which external actions were performed by AI agents. Forge imports audit events from a connected data source and automatically reconciles them with agent actions captured in Forge sessions. This adds agent context to provider audit logs that would otherwise identify only the account used to perform an action.

​
How it works

1

Capture agent activity

Forge records tool calls and other actions from instrumented agent sessions.
2

Import audit events

An attribution connector periodically imports events from the provider’s audit log.
3

Reconcile events

Forge compares each provider event with captured agent actions using the resource, action, provider application, account, and time of occurrence.
4

Record attribution

Forge stores the best match, other candidates, the matched fields, and a confidence score. If no reliable match exists, the record says so.

​
Google Drive

The current connector imports Google Drive events from the Google Workspace Admin audit log. Forge reconciles those events with Google Drive actions observed in agent sessions, including file reads, downloads, creates, edits, renames, permission changes, and metadata access. The connector runs automatically while active. Its polling interval, import delay, and lookback window control how often Forge imports events and which captured actions it considers. A manual sync can run the same import and reconciliation immediately.

​
Records

Each attribution record contains:
  • The provider event, actor account, action, resource, provider application, and event time.
  • The resulting label and confidence score.
  • The Forge action selected as the best match, with a link to its session when available.
  • The fields that supported the match and other qualifying candidates.
  • The time at which Forge computed the result.
You can filter records by label, actor, resource, event, provider application, confidence, and time.

​
Outcomes

Human or unobserved does not prove that a human performed the action. It can also mean that the responsible automation was outside Forge’s session coverage.

​
Matching

Forge requires compatible resource and action evidence before it attributes a Google Drive event to an agent action. It then scores supporting evidence such as:
  • Exact file or document ID, or a matching resource title.
  • Compatible action type and provider event.
  • Provider application or API method.
  • Actor and target accounts.
  • Changes to values or permissions.
  • Proximity between the provider event and captured action.
Events more than ten minutes from a candidate action are not attributed to that action. Missing, stale, or drifted managed configuration can also reduce the result’s confidence.

​
Overrides

You can replace a computed label and optionally record a reason. Forge retains the original result and records the override in the organization audit log.