> ## Documentation Index
> Fetch the complete documentation index at: https://docs.komodor.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit log

> An append-only record of every governed change and every sensitive read — written in the same transaction as the change itself.

The audit log answers "who changed this, and when" for your workspace. It records every governed
mutation and an explicit set of sensitive reads, and it is append-only: entries are never edited or
deleted. This page covers what is recorded, what deliberately is not, and the property that makes
the log trustworthy. Find it under **Settings → Audit log**.

## The property that matters

**An audit row is written in the same transaction as the change it describes.** A change cannot land
without its record, and a record cannot exist for a change that did not land. That is the difference
between an audit log and a log that happens to contain audit-like messages.

Rejected attempts are captured too. An action somebody was not allowed to perform is as interesting
as one they were, and both appear with their outcome.

## What is recorded

Every governed mutation, across every area of the platform:

| Area                     | Examples                                                                                                                                         |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Members**              | Invitations, suspensions, restorations                                                                                                           |
| **Service accounts**     | Creation, disabling, re-enabling                                                                                                                 |
| **API keys**             | Creation, including which roles were granted; revocation; revealing a token                                                                      |
| **Authorization**        | Role, policy, and grant changes; role assignments; attribute changes; access checks against another identity                                     |
| **Workspace**            | Settings updates, trusted-domain changes                                                                                                         |
| **Agents**               | Creation, enable and disable, archiving, worker-token creation and revocation, label and tool-group changes, invocations, chat-session lifecycle |
| **Runs**                 | User-initiated actions — create, revive, cancel, grade                                                                                           |
| **Workflows**            | Creation, update, deletion, and runs                                                                                                             |
| **Triggers & schedules** | Creation, update, deletion, credential rotation                                                                                                  |
| **Channels & routing**   | Creation, update, deletion, pause and resume, route changes                                                                                      |
| **Integrations**         | Connecting, creating, deleting, testing a connection                                                                                             |
| **Credentials**          | Creation, update, value replacement, deletion, binding and unbinding                                                                             |
| **MCP servers**          | Creation, update, deletion, authorization, credential binding, groups and policies                                                               |
| **Knowledge bases**      | Lifecycle, document ingest, reindex and delete, agent access grants                                                                              |
| **Quality**              | Score and judge configuration changes                                                                                                            |

Each entry records the action and the area it belongs to, **who** did it — including who was acting
on whose behalf, where an action was taken on someone's behalf — **when**, and whether it
**succeeded or failed**. For updates, the details carry the old and the new value.

## What is not recorded

* **Ordinary reads.** Reading a run or listing agents is not audited. A small, explicit set of
  sensitive reads is: revealing an API key's token, and checking another identity's effective
  access.
* **Message content.** Chat and channel message bodies live in their own run and evidence ledgers,
  not here.
* **Secrets, ever.** Revealing an API key records *that* the key was revealed, never the token.

## Reading the log

Entries are listed newest first with pagination, filterable by area to narrow to one kind of change.
Open an entry for its full detail — actor, operation, status, and the recorded change.

Reading the log is its own capability. Among the built-in roles it reaches **Viewer** — which
holds every read capability, the audit log included — as well as **Owner** and **Admin**, which
hold the full catalog. That is what lets you hand somebody read-only oversight without granting
them the ability to change anything.

<Note>
  An agent's name is stamped into an entry when the entry is written, rather than resolved when you
  read it. A row says what was true at the time, so renaming an agent later does not rewrite its
  history.
</Note>

## Scope

The audit log covers **your workspace** — your team's own actions. Platform-level administration is
recorded separately; see [Admin Console](/security-and-governance/controls/admin-console).

## Next steps

<CardGroup cols={2}>
  <Card title="Roles & permissions" href="/security-and-governance/identity-and-access/roles-permissions">
    Who can read the log, and how that is granted.
  </Card>

  <Card title="Approvals" href="/security-and-governance/controls/approvals">
    Human decisions, and where they are recorded.
  </Card>

  <Card title="Runs & evidence" href="/manage-your-agents/run/runs-evidence">
    The other ledger — what an agent saw and did.
  </Card>

  <Card title="Admin Console" href="/security-and-governance/controls/admin-console">
    Administration that happens above a single workspace.
  </Card>
</CardGroup>


## Related topics

- [Outbound webhooks](/manage-your-agents/run/outbound-webhooks.md)
- [Google Cloud Investigator](/manage-your-agents/build/catalog/gcp-investigator.md)
- [Data flow](/get-started/architecture/data-flow.md)
- [Support](/reference/support.md)
- [Secrets & credential handling](/security-and-governance/architecture-considerations/secrets-credential-handling.md)