Flight Recorder
Every tool call in order, with its Guard decision.
Press 7. Flight Recorder is the answer to "what did it actually do?" — every tool call
Claude made, in order, with the Guard decision attached to each one.
What it records
The PostToolUse hook writes an entry for every tool invocation to the action ledger at
.claude/action-log.json. Each entry carries the tool name, its arguments, the
normalized effect Guard computed, the decision and rule that applied, and the outcome.
| Time | Call | Decision |
|---|---|---|
12:41:02 | Read src/guard/policy.mjs | ALLOW |
12:41:04 | Grep -rn TODO src | ALLOW |
12:41:08 | Bash npm test | ALLOW |
12:41:16 | Write ~/.ssh/config | ASK |
12:41:21 | Bash aws s3 rm s3://acme-prod-assets | DENY |
Reading a call
Open any row to see the full call in the drawer. Inside it, j and k step
through calls without closing, and Esc closes. The drawer shows the arguments as sent,
the effect Guard derived from them, and the rule that produced the decision — which is the fastest way
to understand why something was denied.
Correlating with the model traffic
Tool calls and model requests are two different streams: the hook sees the former, the proxy sees the latter. Iris correlates them so you can move from a call in Flight Recorder to the turn that requested it, and read the context that turn carried.
Filtering and export
The header time range — Last hour, Today, This week, This month, All — filters this view along with
everything except Optimize. Export writes history, actions or decisions as JSON or CSV to
~/.iris/projects/<id>/exports/.
Nothing is uploaded. Clear captured data in the UI removes only files this proxy wrote. See Security & privacy for exactly what is stored where.