The property that matters
An audit row is written in the same transaction as the change it describes. A change cannot land without its record, and a record cannot exist for a change that did not land. That is the difference between an audit log and a log that happens to contain audit-like messages. Rejected attempts are captured too. An action somebody was not allowed to perform is as interesting as one they were, and both appear with their outcome.What is recorded
Every governed mutation, across every area of the platform:
Each entry records the action and the area it belongs to, who did it — including who was acting
on whose behalf, where an action was taken on someone’s behalf — when, and whether it
succeeded or failed. For updates, the details carry the old and the new value.
What is not recorded
- Ordinary reads. Reading a run or listing agents is not audited. A small, explicit set of sensitive reads is: revealing an API key’s token, and checking another identity’s effective access.
- Message content. Chat and channel message bodies live in their own run and evidence ledgers, not here.
- Secrets, ever. Revealing an API key records that the key was revealed, never the token.
Reading the log
Entries are listed newest first with pagination, filterable by area to narrow to one kind of change. Open an entry for its full detail — actor, operation, status, and the recorded change. Reading the log is its own capability. Among the built-in roles it reaches Viewer — which holds every read capability, the audit log included — as well as Owner and Admin, which hold the full catalog. That is what lets you hand somebody read-only oversight without granting them the ability to change anything.An agent’s name is stamped into an entry when the entry is written, rather than resolved when you
read it. A row says what was true at the time, so renaming an agent later does not rewrite its
history.
Scope
The audit log covers your workspace — your team’s own actions. Platform-level administration is recorded separately; see Admin Console.Next steps
Roles & permissions
Who can read the log, and how that is granted.
Approvals
Human decisions, and where they are recorded.
Runs & evidence
The other ledger — what an agent saw and did.
Admin Console
Administration that happens above a single workspace.