Jump To Inventory Page

Sessions Meaning Layer

Session inventory should rank the work that changed trust, touched sensitive context, or crossed a company boundary before it lists every run.

The raw session table is still useful, but the first read should explain which sessions widened scope, changed confidence, or created the next investigation path.

Operator Brief

2 sessions matter now

One active session widened scope into sensitive files and one ended session still explains the current unknown-key narrative.

Question This View Answers

Which session changed the overall security picture?

High-signal sessions

1 active, 1 ended but still explanatory

Sensitive repo touches

Concentrated in one workstream

Cross-entity links

Key, host, file, model, and outbound path

Background sessions

Stable and low-value for the first read

c6 List Reference

c6 shape: summary strip, relationship map, then a session ledger.

Active

Live now

Total (24h)

Recent runs

Total cost

$52.48

Session spend

Unique users

Distinct actors

Why Borrow This Shape

The meaning page should still feel like the same inventory class from c6: quick signal, recognizable topology context, then a raw ledger you can trust.

Raw Session Ledger

User, agent, endpoint, model, key, timing, and cost.

User	Agent	Endpoint	Model	API Key	Status
alice@company.com	Claude Code v1.2.0	alice-mbp.local	claude-sonnet-4-6	sk-ant-...A3F2	active
unknown	Claude Code v1.2.0	10.0.1.44	claude-sonnet-4-6	sk-ant-...C001	active
bob@company.com	Cursor 0.42.0	bob-thinkpad.local	claude-opus-4-6	sk-ant-...A3F2	ended

Why Sessions Matter

Interpretation before the full raw catalog.

Sessions are the unit of consequence

They bind user, host, credential, files, tools, and outbound calls into one explainable lane.

A good listing page should rank by significance, not just recency.

Raw totals hide the story

Most sessions are background noise. A small number explain the current risk picture.

The value is in spotlighting the few sessions that changed posture.

A session page should answer what happened

Security needs a narrative summary before a turn table or cost chart.

Rows remain useful after the meaning layer points at the right place.

Priority Queue

The fastest drill paths for this entity type.

Shared-key session touching auth code

Ended session that still anchors the unknown-key narrative.

Open significance story

Why It Matters

It links the key, repo, host, and model traffic together.

Live session on unresolved host

Active work from a weakly attributed endpoint.

Open raw session list

Why It Matters

Trust is lower because host ownership is still incomplete.

Replay candidate with boundary crossing

Short replay window where file access leads into outbound calls.

Open boundary story

Why It Matters

Useful for explaining sequence to an operator quickly.

Sessions Relationship Map

Representative item showing adjacency, consequence, and next drill path.

Session significance map

One session binds together the inventory types that explain the current story.

Use a session-centric map to show why the session listing is more than a table of costs and timestamps.

Identity, adjacency, activity, and posture around one representative item.

Identity anchors

Attribution starts here.

alice@company.comknown owner

alice-mbp.localdeveloper host

Shared lanes

These widen blast radius.

sk-ant-...A3F2shared org key

Claude Code v1.2.0common execution lane

session

sess_01XFa9q...

Alice on a developer endpoint using a shared key while touching auth-related company files.

high-signal session

Company context

This makes the session consequential.

/projects/api-refactorauth repo path

.env + config.tssensitive file cluster

Outbound paths

This is where boundary questions appear.

api.anthropic.comexpected provider path

secondary hostclassify this path

linked entities

trust level

medium

company consequence

high

next drill

raw timeline

Representative Entity

The detail page should feel like the natural next click.

sess_01XFa9q...

Use one representative sessions item to explain what a high-signal detail page should surface first.

Bridge from category significance into an evidence-backed item story.

Open detail story

Raw Evidence Paths

Keep the ledger close, but secondary.

Raw Sessions Listing

Full rows, totals, timestamps, and supporting inventory attributes.

Open raw list

Representative Raw Detail

Inspect the canonical entity page after the meaning layer narrows focus.

Open raw detail