Step 4: Outcome and audit

⚡ 2 min read

Terminal states

State	SDK	MCP / hook
Verified	`decision: 'stepup'`, `status: 'verified'` — proceed	Retry command; verified sid attached to level-2 API calls
Rejected	`status: 'rejected'` or overlay dismissed	Pending cleared; agent must start a new session
Denied (RBAC)	`decision: 'deny'`	Hard block — no MFA offered
Expired	Poll timeout (~10 min TTL)	Same — create a new session

Stage	Tag	Severity	Webhook
Hook blocks, session opened (MFA pending)	—	—	Session webhook (verify URL)
MFA success on auth page	`{resource}:{action}` or `mcp:stepup`	high	Yes
MFA failure / cancel	same tag	high, `status: false`	Yes
Retry after verified session	`guard_gate_decision` (`allow`)	low	No
Step-up session create failed	`guard_gate_decision` (`deny-stepup-failure`)	medium	No

Metadata on MFA rows includes type: mcp-stepup and method (passkey, totp, email-otp, …).

View in Console Audit Logs or MCP get_security_logs. Notification rules: Webhook.

After step-up succeeds, you can log business actions separately:


await transcodes.trackUserAction({
  tag: 'documents:delete',
  severity: 'high',
  status: true,
  metadata: { documentId: 'doc_123' },
});