81% deployed. 14% governed. Log every tool call.

Agent adoption has outpaced security and FinOps approval in many organizations. Without per-tool audit you cannot answer who fetched what, when, at what token cost—for compliance, incident response, or monthly review. Audit & Compliance is how SmartGate makes the intelligence layer accountable: every MCP and REST invocation can write a team-scoped audit record that is queryable, trace-linked, and exportable.

Records land in PostgreSQL-backed audit logs with fields such as team_id, request_id, tool, params, token_used, latency_ms, and success. Dashboard Activity Logs and /api/v1/audit/trace let you filter by tool, time, and team. GET /api/v1/audit/export supports compliance workflows that need a portable artifact. Retention follows the plan catalog SSOT—marketing pages read the same catalog the product enforces, so Free, Pro, Teams, and Enterprise show different day counts without hand-typed drift.

Audit is also how Token Control proves itself. Compress savings are not a slogan; token_saved for context_gate appears on the audit path the dashboard uses for estimated gateway counterfactual savings. Multi-tenant isolation is not optional chrome: every query is scoped by team_id so shared workspaces do not leak another team's tool history. That is agent intelligence governance, not a generic API gateway access log.

SmartGate remains an MCP-native algorithmic gateway—an intelligence layer between AI and the world—not an LLM proxy and not a substitute for your host model. Audit does not claim to be a full SIEM, nor does it invent customer logos or deployment percentages as proof. Where marketing cites industry context, treat it as framing for why production agents need logs; your source of truth for what ran is the audit row your own team produced.

Use Audit & Compliance when platform, security, or FinOps stakeholders need evidence that Research, Context, Memory, Control, and Pipeline calls are attributable. Wire the same gateway URL your builders already use; enable Activity Logs in the dashboard; export when a reviewer asks for a window. Pair with Traffic Customs and Token Control so the rows describe shaped, capped traffic—not an invisible firehose of tool calls.

Expect questions about retention by plan, whether params are stored, how traces stitch a multi-step pipe, and how playground runs differ from production MCP keys. Point reviewers at plan-catalog-backed retention, team isolation, and the export endpoint. Clarify that Est. USD saved is a gateway benchmark for tool modules, not a restatement of the vendor LLM invoice. Clarify that Free and Playground rate limits soft-fail with HTTP 429 by design.

Do not position audit as a reason to replace your existing observability stack. Position it as the tool-layer ledger those stacks rarely see: MCP tool name, parameters, tokens, latency, and success for each call through SmartGate. That ledger is what makes the five intelligence capabilities operable in production instead of demo-only.