Investigations
When security, HR or legal needs to know what someone sent to an AI service and what came back, ANTS Platform gives you three things in one place: a search across AI interactions, the full conversation behind any result, and investigation queues to run the case.
Search runs on Discover AI > Tracing. Listing traces needs the Tracing & Sessions permission, and opening their prompt and response content needs the content permission (pii:read), which Owner and Security & Compliance have among the built-in roles. Investigation queues are under Investigations in the sidebar; among the built-in roles, Owner can create and work them. See Members & Roles.
Search interactions
Use the filters on the trace table to narrow interactions down:
| Search by | How |
|---|---|
| User | A User ID filter, or the IDs / Names search mode, which matches user IDs. |
| AI service | The AI service filter: the agent name or the model provider. |
| Data classification | The Data classification filter: traces where AI Guardrails found PII, PCI or PHI. |
| Policy decision | The Policy decision filter: the guardrail result, Pass, Blocked or Sanitized. |
| Time range | The date range, from 30 minutes to All time. |
| Free text | The Full Text search mode, which also searches prompt and response content. |
Filters combine, so one search can answer "which blocked requests containing payment data did this user send to this AI service last month?". Save the result as a table view to come back to it or share it with a colleague.
Data classification and policy decision come from AI Guardrails. A trace that guardrails have not checked has neither, so it does not match those filters. Turn on detection for the agents you need to investigate; see PII Detection.
How far back you can search follows the organization's data retention setting: from 30 days to 7 years, or indefinite.
Activity from the Discover AI browser extension and desktop agents is searched on the Discover AI pages, by AI tool, category, department, user and time. See Understanding the Discover AI Dashboard.
Reconstruct a session
Find the interaction
Filter the trace table until you find the request you are looking for.
Open it
Select the row to open the trace with its input, output and every step that produced the answer.
Open the session
Select the session badge on the trace. The session shows every trace in the conversation in time order, with input and output, so you can read the whole multi-turn exchange.
Every trace and session you open is recorded in the audit log as a content view.
Investigation queues
An investigation queue holds the evidence for a case. Collect traces, sessions and Discover AI events in a queue, assign each item, record notes and tags, track its status, and export the queue when the case is done.
Create a queue
On the Investigations page, select New queue and enter a name and a description, for example the case reference and what is being investigated. Assign the members who work the queue.
Add evidence
| Evidence | How to add it |
|---|---|
| Traces | In the trace table, select rows and choose Add to Annotation Queue, then pick the investigation queue. On an open trace, use the queue menu in the header. |
| Sessions | In the sessions table, select rows and choose Add to Annotation Queue. On an open session, use the queue menu in the header. |
| Discover AI events | On a Discover AI user's page, open a session and choose Add to queue. |
An item that is already in a queue shows In queue(s).
Work the items
Each item in a queue has:
| Field | Meaning |
|---|---|
| Status | Open, In progress or Closed. |
| Assignee | The member responsible for the item. |
| Tags | Labels for grouping and filtering, such as the policy involved or the outcome. |
| Notes | Comments on the item, with author and time. A note on a trace or session also appears in that trace's or session's comments. |
Opening the prompt and response content of a queued trace or session needs the content permission, like anywhere else in the console, and each opening is recorded as a content view.
Export a queue
Select Export on the queue and choose CSV or JSON. The file has one row per item, with its status, assignee, tags and notes.
If your cases run in ServiceNow, detections can also open ServiceNow incidents automatically. See AI Violations.
Evidence handling
- Content access: every view of prompt and response content is recorded in the audit log, with the Content views filter to review it.
- Exports: every table and audit log export file has a SHA-256 checksum, and every download is recorded with the user, the time and the file. See Verify an export.
- Content permission: exports of traces and observations need
pii:read, and the public API follows the organization's content-hiding setting. See Data Privacy.
Legal hold and hashing of each record at capture are on the roadmap.
Next steps
- Traces & Observations: every search and filter control.
- Sessions: the conversation view.
- Audit Logs: content views and export downloads.