Need to audit what your Claw agent is actually pulling from Vault? The default logs are noise. You need structured audit logs from the agent itself.

Enable the audit sink in your agent config and pipe it to your SIEM. This captures every secret request, successful or not.

```yaml
# claw_agent.yaml
audit:
enabled: true
sinks:
- type: file
path: /var/log/claw/audit.log
format: json
- type: http
endpoint: "https://logs.internal.example.com/ingest"
```

The JSON log entry gives you the path, timestamp, and agent instance ID. Correlate this with Vault's audit logs using the `request_id`.

```json
{
"timestamp": "2024-05-15T10:23:45Z",
"agent_id": "claw-app-7f8d9e",
"level": "info",
"event": "secret_access",
"path": "secret/data/prod/payment-api/db-creds",
"status": "success"
}
```

Without this, you're blind during an incident. You can't rotate what you don't know was accessed.