> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kontext.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Explore

> Find a session and check each tool call's policy decision and execution.

**Explore** lists every agent session and its tool calls.

## Find a session

Choose a time range in the top right. Explore defaults to the last 24 hours. The **Active sessions over time** chart shows active session counts across that range. Drag across the chart to narrow the range. Select **Clear focus** to restore it.

Use **Search sessions** to narrow the table. The table has these columns:

| Column                 | Shows                                                            |
| ---------------------- | ---------------------------------------------------------------- |
| Session                | The session ID.                                                  |
| User                   | The person the agent ran the session for.                        |
| Endpoint               | The endpoint that ran the session.                               |
| Agent                  | Claude Code, Codex or Claude Cowork.                             |
| Status                 | **Live** while the session is running, **Closed** after it ends. |
| Actions                | The number of tool calls in the session.                         |
| Started, Last activity | The session's start time and latest activity.                    |

Select **Open in Explore** in an endpoint's drawer on [Home](/home/overview) to search Explore for that endpoint.

## Read the tool calls

Expand a session to see its tool calls with **Decision**, **Mode**, **Tool**, **Summary**, **Risk** and **Time**. Turn on **Flagged only** to show calls a risk detector flagged. Select **Load more** to fetch the remaining calls.

The decision records what the policy decided. The mode shows how the endpoint applied it.

| Decision          | Meaning                                        |
| ----------------- | ---------------------------------------------- |
| **Allow**         | The policy allowed the call.                   |
| **Deny**          | The policy denied the call.                    |
| **Eval failed**   | Policy evaluation failed. The call ran.        |
| **No principal**  | Kontext could not tell who the call acted for. |
| **Not evaluated** | Kontext evaluated no policy for the call.      |

| Mode         | Meaning                                                  |
| ------------ | -------------------------------------------------------- |
| **Observe**  | The endpoint recorded the decision and let the call run. |
| **Enforce**  | The endpoint applied the decision.                       |
| **Disabled** | Policies were paused, so Kontext evaluated none.         |

The **Risk** column is advisory. A flag never changes the decision. See [Risk](/risk/overview).

## Open a tool call

Select a tool call to open its drawer. Press `j` and `k` to step to the next and previous call.

The drawer summarizes the decision and mode in one sentence. It then shows the reason, time and duration:

| Drawer says                                           | When                                      |
| ----------------------------------------------------- | ----------------------------------------- |
| "Allowed: the call ran."                              | The policy allowed it in Enforce mode.    |
| "Denied: the call was blocked."                       | The policy denied it in Enforce mode.     |
| "Would deny: but the call ran."                       | The policy would deny it in Observe mode. |
| "Would allow: the call ran."                          | The policy allowed it in Observe mode.    |
| "Policy off: nothing was evaluated and the call ran." | Policies were paused.                     |

If the call failed, the sentence ends with "the call ran and failed." If a person interrupted it, the sentence ends with "the call was interrupted by the user." For an enforced Deny, the reason reads "Blocked by rule" followed by the rule ID.

The drawer has these tabs:

* **Verdict** shows the request, what the agent said it was doing, the execution evidence and the result.
* **Risk** shows detector results from Kestrel, Merlin and the **Additional shell check** under **Detection details**. The tab appears when detector details exist for the call. It also offers **Kestrel feedback** when Kestrel scored the call. Open the drawer from [Risk](/risk/overview) to see the AI assessment or use **Explain with AI**.
* **Input** and **Output** show the captured tool input and output. A **Secrets redacted** tag means Kontext removed credentials before storage. The **Payload capture mode** in [data collection](/deploy/data-collection) controls what you see. Earlier calls retain the data captured under their original setting. **Summaries** keeps redacted parameter summaries. **Omitted** records payload sizes. Enabling **Full payloads** does not recover earlier inputs or outputs.
* **Context** shows who the call acted for, the agent's permission mode, the agent, the working directory, the endpoint, and the session.

The agent's permission mode is separate from Kontext's mode. Kontext enforces policies even when the agent uses bypass mode.

## When something is missing

Explore shows activity shortly after it happens on the endpoint. A tool call may lack a result while its session runs. If you cannot find a session, check the time range, then see [troubleshooting](/deploy/troubleshooting).