Description
Access Audit Log gives workspace administrators an append-only account of changes and security decisions in the authority plane. It records events such as principal creation or suspension, role and grant changes, credential lifecycle operations, approval outcomes, access denials, and spend-cap hits. Entries carry actor and target context, and management reads resolve available principal or role names so reviewers are not forced to interpret raw identifiers.
The ledger is intentionally selective. It captures authority changes and denials, while ordinary allowed data operations remain in the product activity system. Audit emission follows confirmed state changes, avoiding forged history for idempotent updates or no-op deletes. Removed principals degrade to unresolved attribution rather than breaking the feed, preserving historical entries after membership changes.
Selling Points
- Gives security reviewers one chronological surface for the events that change or challenge workspace authority.
- Attributes human and agent actions by resolved identity wherever the historical target still exists.
- Records denied access and approval outcomes, helping explain why automation stopped or an operation never ran.
- Avoids noisy duplication of routine successful actions, keeping the ledger focused on access governance.
- Supports API-backed filtering and pagination for operational review beyond the visual settings surface.
User Story
After an automation incident, a workspace owner opens the Audit Log, filters the relevant period, and finds a credential issuance followed by repeated denials and a revoked grant. The entries identify the agent and administrator involved, while approval events show which action was declined. The owner walks away with an evidence trail sufficient to reconstruct the authority changes without inspecting database records.
Extension Surface
This capability is automatable. Audit queries are available through the access route family in packages/api/src/routes/access.ts, and the UI in apps/web/src/modules/access/management/AuditLogSurface.tsx consumes the same paged service. The vocabulary in packages/access/src/audit-vocabulary.ts is a fixed platform catalog; external callers can read and filter events but cannot register arbitrary event types.
Capabilities & Limits
- Records authority mutations, denials, approval lifecycle, credential events, and agent cap hits.
- Resolves actor and selected target names with null-safe historical behavior.
- Supports paged, company-scoped queries through the Access management API.
- Does not log every allowed authorization check or replace the broader content activity stream.
- Some non-principal target kinds retain their identifier because no stable name resolver ships yet.
Implementation Map
packages/access/src/audit-vocabulary.tspackages/access/src/audit.tspackages/db/src/schema/access-audit-log.tsapps/web/src/modules/access/management/AuditLogSurface.tsx