• honeypot_link – something followed the hidden trap link.
• ua_training / ua_search / ua_fetcher / ua_automation / ua_generic – the request's user agent matched an AI training crawler, AI search crawler, live AI fetcher, driver-controlled browser or scripted HTTP client; the Matched column names the token (e.g. GPTBot, Playwright, curl/).
• authorized_ai – a request that passed using the authorised key (or the session it remembers after the first request), or that matched the AI block exceptions allowlist – recorded so the log can answer was that us? In the current version a request from the server itself (loopback) is not logged this way outside of the honeypot page – it passes silently.
• established_actor – an address previously classified as automation came back with a clean browser identity; reported only.
• browser_extension – the in-page detector found an AI assistant add-on or automation driver inside a staff session.
• agent_report – a declaration submitted without a prior attempt.

The Trail column folds repeat requests from the same address and rule (within an hour) into one row, listing the pages it asked for; a locked badge means that row caused a lock and logged in means a user session was attached. Status moves from new to reviewed or cleared (False positive) as staff work through them.