> ## Documentation Index > Fetch the complete documentation index at: https://docs.sureops.ai/llms.txt > Use this file to discover all available pages before exploring further. # Confidence & Audit Trace > How sureops surfaces its reasoning and decision history so you can calibrate trust over time. Every action sureops takes — and every human decision that shapes an incident — is recorded in a structured trail. This page explains what you can see, what confidence scores mean, and how to use the audit trace to calibrate your trust settings over time. ## Confidence scores ### What they mean The Diagnosis Specialist produces a confidence score for each root cause and recommendation. Confidence reflects how well the agent's proposed root cause is supported by the telemetry evidence it gathered. * **High confidence** (0.80–1.00): Multiple independent signals point to the same root cause. Logs, metrics, and traces all corroborate. * **Medium confidence** (0.50–0.79): Strong primary signal, but some corroborating data is missing or ambiguous. * **Low confidence** (0.00–0.49): Limited evidence, or the available signals are conflicting. The agent is flagging this as a hypothesis, not a finding. ### Per-recommendation confidence Confidence is stamped per recommendation, not just per stage. A diagnosis run may produce one high-confidence root cause and one lower-confidence secondary hypothesis. You can approve the high-confidence action and re-investigate the second. ### How confidence affects auto-approve If you have `autonomous_execution` configured, the system uses risk classification (not confidence) as the auto-approve gate. However, confidence is surfaced on the approval card so you can decide whether a low-confidence finding warrants a manual review even for a normally auto-approved risk level. *** ## Decision trace Every action the agent takes is written to the incident timeline as a structured entry. This gives you a step-by-step record of what the AI did and why. ### What the timeline shows When each stage started and completed, with the triggering reason (AI-driven, human-approved, or human-manual). Every query to an observability tool — metric queries, log searches, trace lookups — with the inputs and outputs. Each recommendation as it was presented, with the reasoning the agent provided and the risk classification. Who approved or rejected each recommendation, when, and from which interface (in-app, Slack). When a human took control, released it, rolled back a stage, or marked a stage complete. Including any rationale they provided. Each diagnosis re-run, why it was triggered, and what focus the agent was given. Prior rounds stay visible for comparison. ### Inferred context is labeled When the agent works with inferred context (for example, it inferred triage severity from metadata because the triage stage was skipped), the timeline labels it as `source: inferred` so you can distinguish agent-derived data from observed facts. *** ## Audit log The audit log is a structured record of every significant event across your organization's incidents. It is distinct from the per-incident timeline in scope and purpose. ### What the audit log covers | Event type | Details recorded | | ----------------------- | -------------------------------------------------------------- | | Approval granted | Actor, recommendation IDs, incident, timestamp, interface used | | Approval rejected | Actor, reason provided, incident, timestamp | | Control taken | Actor, incident, reason, auto-release time set | | Control released | Actor, incident, whether auto-release or manual | | Stage advanced manually | Actor, comment/rationale provided, previous and new stage | | Incident closed | Actor, closure reason, whether AI-driven or human-forced | | Role change | Actor, affected user, old role, new role | | Settings change | Actor, setting key, old value, new value | ### Reading the audit log Go to **Settings → Audit Log**. Available to Admin and Owner roles. You can filter by: * Event type * Actor * Incident ID * Date range The log is immutable — entries cannot be edited or deleted. *** ## Using the trace to calibrate trust The decision trace and audit log are the primary tools for expanding or contracting your automation trust settings. ### When to widen autonomy Look at the last 20–30 auto-approved incidents: * Were the root cause diagnoses accurate? (Check: did the resolution fix the issue, or did verification fail and require a second loop?) * Were confidence scores on auto-approved actions consistently high? * Were there any unexpected side effects from actions taken? If the pattern is clean, consider widening `max_auto_risk` from `low` to `medium` for your staging environment. ### When to tighten Watch for: * Low-confidence diagnoses that were auto-approved and led to verification failures * Recommendations marked `agent_fix_pr` or `human` being misclassified as `agent_runtime` * Any approval that in retrospect should have been rejected Tighten by lowering `max_auto_risk`, or temporarily switching the environment to Supervised mode while you investigate. ### Human control decisions in post-incident RCA When a human manually advances a stage, rolls back, or marks a stage complete with notes, those decisions appear explicitly in the post-incident root cause analysis. The RCA includes a "Human Control Decisions" section listing every manual action with its stated rationale and the actor. This means your in-the-moment comments when taking manual actions become part of the permanent record used for future learning. *** ## What you cannot change The audit trail is append-only by design. You can read it, filter it, and export it, but you cannot edit or delete entries. This is intentional — the value of the audit trail depends on it being tamper-evident. If you need an audit log export for a compliance review, contact sureops support.