Action Integrity
Free action audit
The read-only historical audit of Stripe and agent logs: what it reads, the detectors and the finding classes.
The action audit is the free, read-only way in. It looks at what already happened: your Stripe history and, if you have them, your agents’ tool-call logs. Nothing is executed and nothing changes in your systems. It is free on every plan.
1. Connect Stripe read-only
Add a Stripe connector in read_only mode with a restricted key that has read access to charges, refunds, customers, coupons and subscriptions. If the key can also write, Audon warns you: for the audit, a key with read permissions only is best.
2. Upload agent logs (optional)
Logs let the audit tie money movements to agent tool calls. Two formats:
{"timestamp":"2026-10-31T09:14:02Z","agent":"support-agent","tool":"refund_create","arguments":{"charge":"ch_3QmX…","amount":45000},"result":{"status":"succeeded"}}Or OpenTelemetry (OTLP/JSON) spans that carry gen_ai.tool.name and gen_ai.tool.call.arguments. Upload in the app or with POST /v1/integrity/audit-logs.
3. Run it
Start the audit in the app or with POST /v1/integrity/audits (202). It imports up to 90 days: charges, refunds, coupons and canceled subscriptions (up to 5,000 per type), and customer balance credits for up to 200 customers seen in the period.
What it finds
| Detector | Finds |
|---|---|
duplicate_refund | More than one refund for the same charge or order. |
refund_exceeds_payment | Refunds above the payment, or on a payment already refunded in full. |
large_refund, large_credit, large_discount | Amounts above three times the period’s 95th percentile or your stated threshold; coupons of 50% or more. |
customer_burst | Three or more money actions for one customer within 24 hours. |
agent_burst | An agent making at least max(10, 5 × its median) calls in an hour. |
failed_action | Actions that failed at the provider. |
repeated_action | The same agent, tool and arguments within 10 minutes. |
refund_without_intent | With logs: a refund with no matching agent call within 15 minutes. |
Finding classes
- Flagged action: worth a look.
- Suspected loss: money that likely left in error.
- Confirmed loss: duplicate refunds that both succeeded at the provider while the log shows two separate refund calls, or a loss a person confirmed.
Found, not prevented
The audit finds losses that already happened. They can be recovered, but they are never counted as prevented. Prevention starts when live actions run through Audon: see the quickstart or the Action Gateway.