Audit trail
Every change and every agent call in the project for a closed period, in one timeline, with a summary and a note on what the answer rests on. It answers audit questions: what changed and who approved it, what a token did, whether something ever happened.
Asking a question
- Choose the period (from and to; the end day is included), then narrow it: a person, an agent, a token prefix, a code, a kind (for example Agent policy and rules, or Access and roles), an action or words.
- The cards count the period: changes and agent calls, policy and access changes, refused calls, masked secrets and production emergencies.
- Export CSV gives every matching entry, with the notes on completeness at the end.
- Coding agents ask the same with get_audit_trail: mode exists answers yes or no with the first and last time, mode summary gives the counts.
What the answer rests on
The change history goes back to the project's start. Agent calls are traced since the call trace began; before that the older access log is used, which does not know whom an agent acted for, so a person filter cannot include it. Full agent answers are kept 90 days, then only their beginning and fingerprint. A redacted value is shown as [redacted] and the redaction is itself an entry. When more entries match than can be read, the page says so.
Who sees what
Workspace owners, admins, auditors and people who manage the project's integrations see the whole trail. Everyone else sees their own: their changes and the agent calls made for them. Nothing in the trail can be edited.