# See who did what

> Every write records who made it: the token, the program or agent, its model and session. Read it in the journal, the history and the change feed.

Every write records its actor: the credential that made it, and, when the caller says so, the program or agent behind it, its model and its session. The journal, the history and the change feed show it, so you can tell who changed what and undo one agent’s work without touching the rest.

## What the actor records

The actor has these fields:

* **`auth`**: the credential, `owner` or the name of a [named token](https://datanotes.dev/guides/security/tokens/); the engine sets it, and no header can claim it
* **`harness`** and **`harness_version`**: the program or MCP client, such as `claude-code`
* **`model`**: the model behind an agent
* **`session`**: the agent’s session
* **`tool`**: the tool the agent called

A program sends the other fields with the `X-Datanotes-Actor` header, or the client’s `actor` option, as [Record who makes each write](https://datanotes.dev/develop/http-api/#record-who-makes-each-write) shows. `datanotes mcp` fills them from the MCP connection, as [Every write names the agent that made it](https://datanotes.dev/guides/agents/how-agents-use-datanotes/#every-write-names-the-agent-that-made-it) explains.

## See which token made a change

Every write records the credential as `auth` in its actor: `owner`, or the token’s name. When a program forwards an agent’s `X-Datanotes-Actor` header, the engine records both, as “harness / model via token”. A program that writes for itself, without the header, appears under its token’s name.

`list_migrations` shows this name in the `by` field of each change, and `list_changes` shows the whole actor.

## Report what an agent does

A program that serves its own Model Context Protocol (MCP) server can report its agents to the engine, with any token:

* **`POST /datanotes/sessions/identify/`**: names the model and harness behind an agent’s session; later writes that carry the session in `X-Datanotes-Actor` record them
* **`POST /datanotes/tool-calls/record/`**: records a tool call on the change feed, with `served_by` naming who served it

Tool calls appear on the change feed as events with `kind: "tool_call"`, sent only to consumers that ask for that kind. The `call` field holds `tool`, `ok`, `served_by`, `duration_ms`, `summary` and `session`, the arguments cut at 300 characters, the value cut at 1,000, and the result’s size in `result_chars` and `result_tokens`.

## Read who did what

Three operations read the record:

* **`list_migrations`**: the journal, newest first, each write with `by`, the actor’s name
* **`describe_history`**: the commits of one table or of every table, with the full actor; it needs history on
* **`list_changes`**: every change with its actor, and with `kinds: ["tool_call"]` every tool call an MCP server reported

`restore_database` with `before_migration` brings every table back to the moment before an agent’s first write: [Restore a table or the database](https://datanotes.dev/guides/history/restore/) shows it.