Audit log

Reading the audit log needs audit access, which the Auditor role grants on its own without granting anything else.

#What gets recorded

Every action that changes who can do what, plus the decisions made about non-human principals. A permission grant or revoke, a role change, a registered agent approved or suspended, a share link created, and a billing plan granted.

Each row names the action, who performed it, when, and what it was done to. So a question like which admin gave someone security access last month is a lookup rather than an investigation.

#Finding a row

The filter matches the action name, and action names are written as a subject and a verb: role.grant, agent.approve. Typing the subject on its own narrows to everything done to it.

That is usually faster than scrolling, because the log keeps every privileged action the workspace has ever taken.

#Why it is append-only

A record that the people it describes can change answers a different question from the one you are asking. Nothing writes to a row after it is created, and nothing removes one, so what the log says happened is what happened.

How long rows are kept is a billing plan limit, shown as Audit retention on Plans and billing.

The audit log is included with Enterprise. See Plans and billing.