An AI agent broke something. How to trace what ran and whose yes let it
A runbook for the hour after an AI coding agent's mistake: find the change, the session and the decision, and know which of them can actually name a person.
Start from the damage and work backwards: the change, then the session that made it, then the decision that let it run. The first two are usually easy to find. The third is the one teams want, and it exists only if someone recorded it at the time.
Everything about Claude Code, Codex, Cursor and Copilot here was checked against their docs on 6 and 7 November 2026.
Key takeaways
- Git and cloud logs name the identity the agent used, which is usually a person's, not the approver.
- A Claude Code transcript shows the command, not who allowed it.
- Claude Code's
tool_decisiontelemetry names who accepted a prompt, but only if it was on beforehand. - Codex, Cursor and Copilot have no documented event that names who approved a local step.
1. Find the change
Look where the damage happened:
- Code:
git logandgit reflogon the branch, and the pull request if there is one. The author is the git identity on the machine where the agent ran. - Deploys and infrastructure: your CI run history and your cloud provider's audit log. They name the credential that made the call.
- Data: your database's own logs, if it keeps them, and the application logs around the time.
Write down the exact command or API call and the time. You need both for the next step.
If the agent ran with a person's credentials, every one of these logs names that person. That tells you whose session it was. It doesn't tell you whether they approved the step, or were at their desk at all.
2. Find the session
Match the time to an agent session on the machine that made the change.
Claude Code keeps each session's transcript on that machine, under ~/.claude/projects. It shows the prompt, every tool call with its input, and what came back. Search it for the command you wrote down. Codex and Cursor keep their own session history on the developer's machine too.
The transcript tells you what the agent was asked to do and what it ran. If the permission prompt was rejected, you'll see that. If it was accepted, you'll see the result, and nothing about who accepted it.
3. Find the decision
This is the step that names a person, and only one of the four big tools records it out of the box:
| Tool | A record that names who approved a local step |
|---|---|
| Claude Code | claude_code.tool_decision, with the decision, its source and user.email for OAuth sign-ins, if OpenTelemetry was sending to your collector |
| Codex | codex.tool_decision records approved or denied, with no user identity documented |
| Cursor | No permission decision event for the editor or CLI |
| GitHub Copilot | The audit log covers agent activity on GitHub.com, not approvals in local sessions |
So for most teams the honest finding is: we know whose session ran it and what it ran, and we don't know who said yes. Who approved it? has the detail and the sources for each tool.
If your team uses Pushary for Teams, open Activity and filter to the person and the period. Sessions shows whose agent it was, the commands it reported and each question it asked, with who answered in the phone app, Mac app or dashboard. A yes typed at the agent's own prompt, or given from a web link, has no name there either.
4. Write it up without guessing
In the postmortem, keep three things apart:
- What ran, from the logs and the transcript.
- Whose session it was, from the identity the agent used.
- Who approved it, only if a record names them. If none does, say so.
Blaming the person whose name is on the commit, when nothing shows they approved the step, is how teams stop trusting the tools and each other. Who is accountable when an AI agent makes a mistake? covers the ownership side.
5. Set up the record for next time
- Give agents their own credentials. A deploy key or role for the agent means the logs say "agent", and the person's account isn't used for steps they never saw.
- Turn on Claude Code's telemetry and send it to a collector you run. Claude Code managed settings for a team has a file that does it for everyone.
- Send steps that reach production to a named person. A routing rule on Pushary for Teams sends a matching step, such as a push to your infrastructure repository, to a lead, and records who said yes. It doesn't lock the terminal: if the lead doesn't answer in time, the person at the agent's own prompt can still approve, and that yes isn't recorded.
Team is $59 a month for 5 people, plus $12 a month for each extra person, and new workspaces get 3 days free.
Frequently asked questions
Does the git commit author show who approved an AI agent's change?
No. The commit author is whoever's git identity was configured on the machine the agent ran on. It tells you whose session it was, not who approved the step, and an agent can push with that identity whether or not anyone said yes.
Does a Claude Code session transcript record who approved a tool call?
No. The transcript on that machine, under ~/.claude/projects, records what the agent ran and what came back, so it shows the step. It does not name who accepted the permission prompt. Claude Code's claude_code.tool_decision telemetry event does, with user.email for OAuth sign-ins, but only if OpenTelemetry was turned on before the incident.
What should a team set up so the next incident has an answer?
Three things: give agents their own credentials so logs say agent rather than a colleague's name, send Claude Code's telemetry to a collector you run, and send steps that reach production to a named person whose answer is recorded, for example with a routing rule on Pushary for Teams. A yes typed at the agent's own prompt still leaves no name.