> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Attribution

> Reconcile external audit events with agent activity captured by Forge.

Attribution identifies which external actions were performed by AI agents.
Forge imports audit events from a connected data source and automatically
reconciles them with agent actions captured in Forge sessions.

This adds agent context to provider audit logs that would otherwise identify
only the account used to perform an action.

## How it works

<Steps>
  <Step title="Capture agent activity">
    Forge records tool calls and other actions from instrumented agent sessions.
  </Step>

  <Step title="Import audit events">
    An attribution connector periodically imports events from the provider's
    audit log.
  </Step>

  <Step title="Reconcile events">
    Forge compares each provider event with captured agent actions using the
    resource, action, provider application, account, and time of occurrence.
  </Step>

  <Step title="Record attribution">
    Forge stores the best match, other candidates, the matched fields, and a
    confidence score. If no reliable match exists, the record says so.
  </Step>
</Steps>

## Google Drive

The current connector imports Google Drive events from the Google Workspace
Admin audit log. Forge reconciles those events with Google Drive actions
observed in agent sessions, including file reads, downloads, creates, edits,
renames, permission changes, and metadata access.

The connector runs automatically while active. Its polling interval, import
delay, and lookback window control how often Forge imports events and which
captured actions it considers. A manual sync can run the same import and
reconciliation immediately.

## Records

Each attribution record contains:

* The provider event, actor account, action, resource, provider application, and
  event time.
* The resulting label and confidence score.
* The Forge action selected as the best match, with a link to its session when
  available.
* The fields that supported the match and other qualifying candidates.
* The time at which Forge computed the result.

You can filter records by label, actor, resource, event, provider application,
confidence, and time.

## Outcomes

| Label               | Meaning                                                                                         |
| ------------------- | ----------------------------------------------------------------------------------------------- |
| Agent attributed    | A captured agent action strongly matches the provider event.                                    |
| Likely agent        | A captured agent action matches, but the available evidence is not strong enough to confirm.    |
| Human or unobserved | Forge found no qualifying agent action and the provider event has no automation marker.         |
| Unknown automation  | The provider identifies an application or API action, but Forge found no matching agent action. |
| Conflict            | Multiple captured agent actions are similarly plausible matches.                                |

`Human or unobserved` does not prove that a human performed the action. It can
also mean that the responsible automation was outside Forge's session coverage.

## Matching

Forge requires compatible resource and action evidence before it attributes a
Google Drive event to an agent action. It then scores supporting evidence such
as:

* Exact file or document ID, or a matching resource title.
* Compatible action type and provider event.
* Provider application or API method.
* Actor and target accounts.
* Changes to values or permissions.
* Proximity between the provider event and captured action.

Events more than ten minutes from a candidate action are not attributed to that
action. Missing, stale, or drifted managed configuration can also reduce the
result's confidence.

## Overrides

You can replace a computed label and optionally record a reason. Forge retains
the original result and records the override in the organization audit log.