{
  "call_id": "tc_001",
  "parent_request_id": "req_abc123",
  "timestamp": "2026-03-15T14:33:12Z",
  "tool_name": "database_query",
  "parameters": {
    "query": "SELECT * FROM customers WHERE region = 'EU'",
    "database": "production_crm"
  },
  "result": {
    "rows_returned": 1847,
    "columns": ["name", "email", "phone", "address"],
    "truncated": true
  },
  "authorization": {
    "user_id": "user_42",
    "permissions": ["read:customers"],
    "policy_decision": "allow"
  },
  "execution_time_ms": 234,
  "model_reasoning": "User asked for EU customer contact information for the quarterly report."
}

-- 偵測與使用者對話主題不匹配之工具呼叫
-- 需對話上之主題標記
SELECT
    tc.call_id,
    tc.tool_name,
    tc.parameters,
    tc.timestamp,
    c.topic_classification,
    tc.user_id
FROM tool_calls tc
JOIN conversations c ON tc.parent_request_id = c.request_id
WHERE tc.tool_name NOT IN (
    SELECT expected_tool
    FROM topic_tool_mapping
    WHERE topic = c.topic_classification
)
ORDER BY tc.timestamp DESC;
 
-- 偵測每會話異常之工具呼叫量
SELECT
    session_id,
    user_id,
    COUNT(*) AS tool_calls,
    COUNT(DISTINCT tool_name) AS distinct_tools,
    ARRAY_AGG(DISTINCT tool_name) AS tools_used
FROM tool_calls
WHERE timestamp > NOW() - INTERVAL '24 hours'
GROUP BY session_id, user_id
HAVING COUNT(*) > 20
ORDER BY tool_calls DESC;