Audit Center

Authoritative tenant history for user, AI, workflow, integration, configuration, and security activity.

Event evidence

Field	Behavior
`Identity`	Every event has a stable event ID, action, entity type and ID, workspace, severity, actor type, actor ID, and UTC timestamp.
`Change set`	Mutable operations can retain bounded before and after snapshots plus the human or system reason for the change.
`Request context`	Authenticated requests contribute a request ID and source IP. Denied owner/admin routes create tenant-scoped warning events.
`Data safety`	Credential-shaped fields are recursively redacted, oversized structures are replaced by a digest, and exports neutralize spreadsheet formulas.
`Retention`	Events are append-only during normal operation. Approved tenant deletion pseudonymizes identity fields while preserving required governance evidence.

Operational views

View	Purpose
`Event feed`	Newest-first history with 30-second refresh, stable keyset pagination, actor, category, workspace, severity, text, and inclusive date filters.
`Entity history`	Reconstructs the lifecycle of one opportunity, task, artifact, partner, document, or other canonical entity.
`Approvals`	Combines workflow gates, AI action decisions, and artifact review outcomes with the deciding user and rationale.
`AI decisions`	Links model, recommendation, confidence, grounding, citations, proposed actions, human response, cost, latency, and recorded business outcome.
`Security`	Surfaces access denials and elevated authentication, role, membership, API-key, and credential events. Recent elevated events also enter the notification center.
`Reports`	Exports up to 5,000 filtered tenant events as a real PDF report, SpreadsheetML workbook, CSV extract, or structured JSON evidence package.

Access and API

Only workspace Owners and Administrators can open the Audit Center or its API. Every query reapplies tenant scope before filters, pagination, decisions, or export generation.

Endpoint	Purpose
`GET /api/v1/audit`	Dashboard metrics, facets, user activity, and the first event page.
`GET /api/v1/audit/events`	Filtered, cursor-paginated tenant event history.
`GET /api/v1/audit/entities/:type/:id`	Complete retained history for one tenant entity.
`GET /api/v1/audit/approvals`	Human decision and approval history.
`GET /api/v1/audit/ai-decisions`	Explainable AI recommendation, decision, and outcome history.
`GET /api/v1/audit/security`	Security-focused event feed and severity summary.
`POST /api/v1/audit/ask`	Deterministic audit questions with traceable evidence IDs.
`GET /api/v1/audit/export`	Filtered PDF, Excel, CSV, or JSON evidence export.

Open the operational surface at /activity.