Sync open source content 🐝 (from 08418dc31f3a22e6a506d3dcf5c28a6710c6bace)

Author: beezythebot

docs/ai-control-plane/secure/index.mdx

@@ -11,7 +11,11 @@ Secure pages require the organization admin role.
 
 ### [Watchdog](/docs/ai-control-plane/secure/watchdog)
 
-The risk dashboard: findings clustered into ranked signals, with headline metrics, exposure by data type, and suppression and exclusion actions. Any finding opens the full session transcript for investigation. Watchdog replaces the former Risk Overview and Risk Events pages.
+The risk dashboard: findings clustered into ranked signals, with headline metrics, exposure by data type, and suppression and exclusion actions. Any finding opens the full session transcript for investigation. Watchdog replaces the former Risk Overview page.
+
+### [Risk Events](/docs/ai-control-plane/secure/risk-events)
+
+The finding-level log: every policy finding across recently analyzed sessions, one row per finding, with redacted matches, filters, and a risk-focused session view for investigating any single finding.
 
 ### [Guardrails](/docs/ai-control-plane/secure/guardrails)
 

docs/ai-control-plane/secure/risk-events.mdx

@@ -0,0 +1,37 @@
+---
+title: Risk Events
+description: "Review individual policy findings across analyzed agent sessions, with redacted matches and full-session investigation."
+---
+
+import { Callout } from "@/mdx/components";
+
+The **Risk Events** page is the finding-level log: every policy finding across recently analyzed sessions, one row per finding. Open it from **Secure > Risk Events** in the dashboard.
+
+Where [Watchdog](/docs/ai-control-plane/secure/watchdog) clusters findings into ranked signals for triage, Risk Events lists the raw findings themselves — useful for auditing individual matches, tracking down a specific rule or user, or handing a single finding to a teammate.
+
+## Access requirements
+
+<Callout type="info">
+  Viewing this page requires the `org:admin` scope. Access is included in the [default Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) but not the Member role.
+</Callout>
+
+## Event list
+
+Each finding shows its timestamp, category, severity, rule, session name, user, matched content, and the [guardrail policy](/docs/ai-control-plane/secure/guardrails) that raised it. The list loads continuously with a running count of findings shown.
+
+Filters narrow the stream. **Policy** and **Date range** are always visible, and the rest live behind **More filters**:
+
+- **Policy** — including inactive policies, which are labeled and produce a notice
+- **Date range**
+- **Rule ID** — matches rule IDs containing the entered text
+- **User**
+- **Unique matches only**
+- **Assistant** — including sessions with no assistant
+
+## Redaction and reveal
+
+Matched content is redacted by default. Individual matches can be revealed inline, and a **Reveal all** toggle in the header switches the whole view. Findings from natural-language guardrails open a match dialog with the evaluated content.
+
+## Investigating a finding
+
+Clicking a finding opens the session detail in a risk-focused view — the same transcript panel as [Agent Sessions](/docs/ai-control-plane/observe/agent-sessions), with flagged messages highlighted and unflagged messages dimmed. Each finding also has a copyable share link for handing an investigation to a teammate.

docs/ai-control-plane/secure/watchdog.mdx

@@ -8,7 +8,7 @@ import { Callout } from "@/mdx/components";
 The **Watchdog** page shows the riskiest AI usage in the organization, clustered and ranked. Open it from **Secure > Watchdog** in the dashboard.
 
 <Callout type="info">
-  Watchdog replaces the former Risk Overview and Risk Events pages. Old links redirect here.
+  Watchdog replaces the former Risk Overview page, and old Risk Overview links redirect here. The raw finding-level log lives on the [Risk Events](/docs/ai-control-plane/secure/risk-events) page.
 </Callout>
 
 ## Access requirements