raxit explain
raxit explain -- trace why a decision was permit, defer, or deny.
raxit explain <call_id> looks up one decision in the audit log and prints its full trace,
including the exact Cedar policy that produced it — accepts either a call_id or a denial
token.
Usage
$ raxit explain d867c63661454e8497369a08ebaec35d --audit .raxit/var/daemon-audit.jsonl
call_id: d867c63661454e8497369a08ebaec35d
effect: DEFER
reason_code: defer.policy
stage: policy
hint: A review rule matched; a human must approve via: raxit approvals approve <token>.
agent: default-agent
action: tool.call
resource: post_to_webhook
adapter: sdk
policy_version: 49e46c6a86004454
timestamp: 2026-07-11T22:28:06Z
args_hash: ced38803a54f367c9786c099db83b5dcf22eba7d448223e27c462e25796e4201
session_id: testbed
denial_token: dt_1373bb3e0bcf139d
chain_position: seq=5 prev_hash=0bc499dda5170ebf7336bd67582d4f15a14097c9c22fcba562a1c7dd0a6ed0dd record_hash=fc9d708826e4acdb6a8ea5a213b072d649a5967c9d7244b033794b76546c80fd
contributing cedar policies:
[defer-post_to_webhook]
@id("defer-post_to_webhook")
@effect("defer")
permit (
principal == Agent::"default-agent",
action == Action::"tool.call",
resource == Tool::"post_to_webhook"
);The contributing cedar policies block is real, emitted Cedar source — the @effect("defer")
annotation is exactly the mechanism that produces the third defer state on top of Cedar's
native binary Allow/Deny.
Looking up by the denial token instead of the call id resolves to the same underlying record:
$ raxit explain dt_1373bb3e0bcf139d --audit .raxit/var/daemon-audit.jsonl
[… identical output …]Flags
--audit <path>— audit log to search (see gotcha below for the default mismatch).
Gotchas
explain's default --audit path is .raxit/var/dev-audit.jsonl, but a daemon started with
raxit serve writes to .raxit/var/daemon-audit.jsonl by default. Looking up a call made
through a serve-started daemon without --audit .raxit/var/daemon-audit.jsonl fails with
"no record found," even though the call is logged:
$ raxit explain d867c63661454e8497369a08ebaec35d
explain: no record found for id "d867c63661454e8497369a08ebaec35d" in .raxit/var/dev-audit.jsonl
$ echo $?
1- Every
[raxit BLOCKED]/defer message printed by the SDK already includes the exactraxit explain <id>command to run — copy it verbatim rather than reconstructing the audit path by hand.