Audit Logs
Immutable, append-only records of every action — the foundation of compliance and trust.
Audit logs in Command Center are the immutable record of every action taken in the system: who did what, when and why. They are append-only — records can be read but never modified or deleted, not even by administrators. This satisfies legal retention requirements and provides tamper-evident evidence for compliance audits.
What Is Logged
- Data access — every read and write of entity records, including who accessed what and when.
- Deployments — every agent, prompt and workflow deployment, with version, author and approval chain.
- Configuration changes — every modification to agent configs, policies and access controls.
- Administrative actions — user management, workspace creation, role assignments.
- Agent executions — pipeline runs, approval gate decisions, reasoning chains.
Compliance Evidence
Compliance reports are generated automatically from the audit trail. SOC 2 evidence (access controls, change management, monitoring), GDPR evidence (data access, retention, deletion) and ISO 27001 evidence (security controls, incident response) are derived from the same structured data. Reports are always current — not reconstructed quarterly from email threads and spreadsheets.
// Audit log entry structure
{
"timestamp": "2026-07-28T19:35:00Z",
"actor": "user@company.com",
"action": "deploy.agent",
"target": "lead-scoring-agent@v3.2.0",
"workspace": "acme-corp",
"details": {
"previous_version": "3.1.0",
"eval_score": 0.92,
"approved_by": "admin@company.com"
},
"immutable": true
}The immutability of audit logs is enforced at the storage level, not the application level. Even a compromised admin account cannot modify or delete audit records. This is the difference between 'we promise not to edit the logs' and 'the logs cannot be edited'.
FAQ
Frequently Asked Questions
Audit logs are retained indefinitely by default, or as required by your compliance framework. GDPR requires specific retention periods for personal data; the system can be configured to purge personal data from audit logs after the retention period while retaining the non-personal audit record.
Yes. Audit logs can be exported via API or SDK in JSON or CSV format. They can also be streamed to external SIEM systems (Splunk, Datadog, Elastic) for organisations that centralise security monitoring.
Related Topics