Audit log

An audit log is a chronological record of security-relevant actions in a system: who acted, what they did, to which object, when, and from where. It exists so that someone can later reconstruct what happened, whether for an investigation, a compliance review or a simple "who changed this?".

What it is

Each entry is an event with a timestamp, an actor (a user, a key or the system), an action, a target and context such as the IP address. Good audit logs are append-only from the point of view of the people being audited, cover administrative changes as well as data access, and are kept for a defined period.

An audit log is different from an application log. Application logs help engineers debug; audit logs answer accountability questions and are read by security and compliance teams.

Why it matters

Compliance frameworks such as SOC 2 and ISO 27001 expect you to show who changed access, keys and configuration. When AI agents act in your systems, the log also has to show which changes a person made and which an AI produced, and who approved them.

In AI CodeOps

Open Measure → Audit Log. Each row shows When, Action, Account, Target, IP and Detail, 50 entries per page, filterable by action. Some of the actions recorded:

member.invited  member.removed  role.changed
apikey.created  apikey.revoked  apikey.scope.updated
provider.credential.added  provider.credential.removed
policy.updated  budget.updated
secret.created  secret.updated  secret.toggled  secret.deleted
approval.decided  approval.canceled
mcp_server.created  mcp_server.updated  mcp_server.deleted
session.code.edited  session.code.created  session.code.deleted
change.evidence_exported  workspace.share_enabled

session.code.* entries record edits a person makes to the code a session generated, before it becomes a pull request, so you can tell AI-written lines from human edits. Sign-ins, two-factor changes and SSO configuration are recorded against the account or organization, not on the workspace page.

Retention depends on the organization's plan:

Free         7 days
Pro          90 days
Enterprise   as long as the organization exists

Older entries are deleted once a day. Reading the log needs the workspace:audit.read permission; see role-based access control.

For a record you can hand to an auditor, export the change's evidence pack: a signed record of the change's findings, tests, approval votes, policy decisions and related audit entries, which you can verify offline with the platform's public key.

Related terms

• Role-based access control (RBAC): who may read the log, and what role.changed records.
• Policy engine: each policy save is a policy.updated entry.
• Human-in-the-loop: approvals recorded as approval.decided.