Skip to content
Help Center Back to AgenticObjects

Audit log

A permanent, append-only record of sign-ins and every administrative change — who did what, and when.

Console 3 min read Updated

The Audit Log is the permanent record of what happened in your AgenticObjects company. Every sign-in and every change to configuration, access and agents is written here the moment it happens, with who did it and when. Entries are only ever added — never edited, never removed.

What this screen is for

When someone asks "who changed this?", "when did that person get access?" or "was there an attempt to sign in as me?", this is where the answer lives. The log serves two readers at once: an administrator checking what their team has been doing, and an auditor who needs proof that the record is complete and untouched.

Because entries are append-only, the log is evidence rather than a note someone kept. What it says happened, happened.

What you see

  1. Audit Log — the page title, with the line Signin events + every mutation, an append-only ledger. underneath it.
  2. The event table, newest first, with five columns:
    • Time — how long ago the event happened. Hover it to see the exact date and time.
    • Event — what kind of event it was, as a badge: a sign-in, or a change such as create, edit, archive or a role assignment. Failed sign-ins are marked in red so they stand out.
    • Actor — the person who did it, or System when no signed-in person is behind the event.
    • Summary — the action taken and the address of the item it touched, so every entry points to exactly one thing.
    • Detail — for a failed sign-in, the email address that was typed.
  3. A note on protected detail — shown to people who do not hold the permission to see full sign-in detail, explaining why some cells are locked.

The table shows the 100 most recent events for your company.

How to …

Check who changed something

  1. Open Audit in the Central Management Console sidebar.
  2. Read down the Summary column to find the item you are interested in — a user, a workspace, a model, an agent.
  3. Look across to Actor for who made it and to Time for when — hover the time for the exact moment.

Review sign-in activity

  1. Scan the Event column for Signin success and Signin failure badges. Failures are shown in red.
  2. For a failed sign-in, the Detail column shows the address that was typed if you hold view_audit_detail. Otherwise it shows a locked permission-gated badge.
  3. A run of failures against one account is worth a closer look.

Get access to full sign-in detail

  1. Ask a company admin to grant you the view_audit_detail direct permission on the Users & Roles screen.
  2. Reload the Audit Log. The Detail column now shows the full addresses in place of the lock.

How to read it

  • Newest is at the top. The list reads backwards in time, so the latest activity is always the first thing you see.
  • A red event badge is a failed sign-in. Everything else uses the neutral badge.
  • System is an actor too. An event with no signed-in person behind it is still recorded in full, and attributed to System.
  • A lock means protected, not missing. A permission-gated cell holds a real value that your access does not reveal.

Good to know

  • The log is append-only. No one — including company admins — can edit or remove an entry.
  • The email address typed in a failed sign-in is treated as the most sensitive personal detail on the screen, so it is masked for everyone except holders of view_audit_detail.
  • The log shows only your own company's events.
  • Seeing the Audit Log requires the admin role or higher.