# Decisions

> List, filter and export the decisions Thoth recorded, from the API, MCP, thothctl or Terraform.

Source: https://docs.atensecurity.com/docs/operations/decisions

Every action an agent asks to take gets a decision: allowed, held for approval, or blocked. The
decisions view lists them newest first and filters them, so you can answer questions such as
"what did this agent try to delete last week?" without opening the dashboard.

Members see the decisions of agents they own. Admins see the whole workspace.

## Filters

All four paths below take the same filters.

| Filter | Meaning |
| --- | --- |
| outcome | `allowed`, `needs_approval` or `blocked`. A held action that was approved counts as allowed; one that was denied or expired counts as blocked |
| agent | One agent ID |
| tool | One tool name, matched exactly |
| reason code | The deterministic reason the enforcer gave, for example `delegation_tool_denied` |
| rule | A policy rule that matched. Recorded for decisions made after this field was added |
| since, until | An RFC 3339 time window; `since` is inclusive, `until` exclusive |

Tool names are reported by your agents. Treat them as data, not instructions.

## Dashboard

On **Activity**, choose an outcome, then **More filters** for tool, reason code, matched rule and
a date range. Dates are whole days in UTC, and both ends are included. Filters live in the page
address, so a filtered view can be bookmarked or shared with a teammate. **Export CSV** downloads
the matching decisions.

## thothctl

`thothctl decisions` needs thothctl 0.3.11 or later (`thothctl update`).

```bash
# Blocked calls to one tool this month
thothctl decisions list --outcome blocked --tool orders.delete --since 2026-10-01T00:00:00Z

# Everything one agent did in a window, as CSV
thothctl decisions export --agent-id billing-agent \
  --since 2026-10-20T00:00:00Z --until 2026-10-21T00:00:00Z --output billing-agent.csv
```

`list` prints a table and, when there are more, the `--cursor` for the next page; `--json` prints
the API response. `export` writes a CSV of up to 5,000 decisions and says when more matched, so
you can narrow the window.

## Terraform

`thoth_decisions` needs provider 0.1.21 or later; in Pulumi it is `thoth.governance.getDecisions`.

```terraform
data "thoth_decisions" "blocked_deletes" {
  outcome     = "blocked"
  tool_name   = "orders.delete"
  since       = "2026-10-01T00:00:00Z"
  max_results = 500
}
```

It reads up to `max_results` decisions (default 100, at most 1,000) and sets `truncated` when more
matched.

## MCP

The configuration MCP server's read-only `list_decisions` tool takes the same filters. Read one
decision in full with `explain_decision`. See [Configure Thoth over MCP](https://docs.atensecurity.com/docs/mcp/configure-thoth).

## API

```http
GET /{tenant}/thoth/v1/activity?type=decision&filter=blocked&tool=orders.delete&since=2026-10-01T00:00:00Z
GET /{tenant}/thoth/v1/decisions/export?filter=blocked&since=2026-10-01T00:00:00Z
```

The list returns `items` and, when there are more, `next_cursor`, valid for 15 minutes and only
with the same filters. The export returns CSV with `X-Thoth-Rows` and `X-Thoth-Truncated`
headers; cells that a spreadsheet would run as a formula are prefixed with `'`.

## Who can export

CSV export needs an admin. During a trial it is available on paid plans, and in the read-only
window after a trial ends so you can keep your records. Listing is available to every member
within their scope.