The Audit log

The Audit tab in Governance is the organization-wide record of who did what, when, and to what. It covers access changes, secrets, Coworker approvals, sign-ins, settings and more, so a security or compliance team can answer questions about past activity from one place. Events are never edited or removed.

Who can open it#

You need the auditor ability (Auditor on the Team page). It is a separate ability: the admin and executive abilities do not include it and do not open the Audit tab. An administrator who should read the log needs Auditor granted like anyone else. See What your abilities mean.

Someone with only Auditor sees Governance in the profile menu and the Audit tab as the last of the Governance tabs. Others who open the page directly see "No access".

What is recorded#

Each event has a time, the person or Coworker who acted, what they did, and what it was done to. The record includes:

Area (filter name)	Examples
Abilities	An ability granted to or removed from a person, including changes that come from single sign-on role mapping
Sign-ins	Successful sign-ins and failed attempts, by password or single sign-on; a single sign-on sign-in also explains the result: the abilities the identity provider granted, how many role or group values it sent, how many matched a mapping rule and how many did not. So "why did this person only get Member?" is answerable from the row. The values themselves, and the person's name and address, are never kept
People	Invitations, revocations, reactivations, deletions, data exports and erasures, and accounts created automatically on a first single sign-on sign-in
Teams	A Team created, renamed or deleted; members added or removed, including by single-sign-on group mapping. The row names the person and the Team, and never the group value
Secrets	A secret created, its value replaced, deleted, or given to or taken from a Coworker
Coworkers	Proposed, feedback left, approved, advanced a phase, sunset, hired, conversation starters updated, profile image set or removed, Supervisor changed, Knowledge Base attached or detached, model changed, Team scope changed, Team affiliation changed. Starter events record only how many starters changed, never their wording, and image events never record the image or its description
Connected-app logins, Connectors, Coworker connections	A connected-app login added, changed (the names of the fields that changed, never the client secret) or removed; a connector attached, synced or removed; a connector function turned on or off or given a different default policy; a custom connector edited, with the names of the fields that changed and, for a change to whether it reads or writes, the old and new value but never its code, guidance or description; custom requests turned on or off for a connector; a change to how Coworkers reach a connected app (through its functions only, or with direct access); a Coworker given a connection or having it taken away
SharePoint connections, Knowledge Base SharePoint sources	A SharePoint connection added, changed (the names of the fields that changed, never the client secret), checked, having its client secret replaced, personal sign-in turned on or off, or removed; a SharePoint source added to a Knowledge Base, its sync schedule changed, a sync started by hand, or the source removed. Summaries carry names, the tenant and client ids and the site address, never the client secret or any file content
Built-in Coworker actions	An administrator changing the setting (Allow, Review, Ask or Block) of an action such as creating a trigger or registering a custom connector, with the action and its old and new setting
Linked accounts, Personal connector policies, Connector approvals	A person linking, reconnecting or disconnecting their own account; a person tightening or clearing their own policy for a function; a person approving or declining a request, with the connector and function but never the details of the request; a Coworker's call that needed approval (and whether it was flagged for review, with the category names but never the reviewer's wording), a request that expired, and the approved call running; and Connector write reviews, a write that passed review and ran. None of these rows carry what the Coworker sent
Triggers	A trigger created, activated, paused, deleted, manually run, or its webhook key rotated. Summaries carry the trigger id, Coworker id, schedule and time zone — never the instruction text or any key
Registered scripts	A Coworker's registered script deleted
Compensation	Rate bands created, updated or archived; assignments set or cleared. Auditors see who an assignment applies to, never the band's name or rate
Single sign-on, Provider keys, Model providers, API keys	Setup changes
Knowledge Bases	A Knowledge Base created, updated, deleted, exported; Coworker access (human-only switch) changed, Team scope changed, Team affiliation changed, editor added or removed, owner assigned. Summaries carry names and field changes, never descriptions or document text
Apps	An App advanced, sunset, Builder assigned, Team scope changed
Workflows	A workflow published (with version, step count and per-step kind); a review item approved or rejected (with the run id and item kind, never the reviewer's message)
Updates	An update started, completed or failed. Completed and failed events are recorded by the system and carry the run id and, for a failure, the step that failed, never the error text
Docker cleanup	A manual cleanup started or finished (with counts of images and containers removed and bytes reclaimed), image retention setting changed
Company settings, Feature switches, Conversation retention	Changes to company-wide settings, including each default model (chat, small, embeddings, image reading and image generation), and each retention cleanup
Global instructions	"Updated the global instructions" and "Restored an earlier version of the global instructions". Summaries carry the version numbers, character count and estimated tokens, never the instruction text
Audit log access	Someone viewed or exported the audit log

Events store names of things and the people involved, never the contents of conversations and never secret values. A failed sign-in for an address that belongs to nobody appears as "Unknown sign-in attempt"; the address that was typed is not kept.

When a person or Coworker is later removed, their events stay, and the name shows as Former member or Former Coworker.

Earlier events#

Some history that began before the audit log existed, such as a Coworker's earlier phase changes, is added to the log from the older records. These events carry a Backfilled label. They may know only the day something happened, so the When column shows a date without a time, and their actor may be Unknown.

Browse and filter#

The Activity view shows the Coworker approvals card, then the list of events, newest first, 50 at a time. Select Load more for older ones.

Coworker approvals shows Awaiting approval (with how long the oldest has waited), Approved (with the share of decided proposals), and Sunset before approval. When some decisions come from earlier records, a note says how many were reconstructed.

Narrow the list with the filters, then select Apply filters. Clear resets them.

Filter	What it does
Person	Events done by one person. People with the same name are told apart by their full email address.
Area	One area from the table above, or Everything.
Target type	The kind of thing the event applies to, such as Secret, Team or Connector.
Target id	One specific thing, by its id.
From and To	Dates, both included.

If the end date is before the start date the page says so and does not apply the filter.

Event details#

Select Details on a row. The dialog is titled with what happened and shows When, Who, On behalf of (when a Coworker acted for a person), Action, Target, Origin (Recorded live or Backfilled from earlier records), Source address (when the event came from a request), and the Event id. Under Details it lists the short facts recorded with the event in plain words, such as which ability was granted, a retention period (Keep forever when there is none), or a count for each kind of data that was erased.

Export#

Select Export at the top of the page. In Export audit log, choose From and To dates (leave them blank for everything) and a Format: JSON Lines (.jsonl) or CSV (.csv). Select Export. The file has every matching event, oldest first, and applies the Person, Area and Target filters you currently have set.

Each event is one line, or one CSV row, with these columns:

Column	Meaning
schema_version	The version of the export layout
id	The event id
created_at	When it happened, in UTC
action	What happened, such as ability.granted
actor_kind, actor_id, actor_name	Who acted: a person, Coworker, API key or the system
on_behalf_of_id, on_behalf_of_name	The person a Coworker or key acted for
target_kind, target_id, target_label	What it happened to
origin	live or backfill
trace_id	The trace id of the request, when there was one
source_ip	The address the request came from, for sign-ins, views and exports of the audit log, and person data exports and erasures; empty for events with no request behind them
summary	The short facts recorded with the event

In the CSV, the first row holds the column names, and a cell that starts with =, +, - or @ is prefixed with an apostrophe so a spreadsheet never runs it as a formula.

Viewing and exporting are recorded too#

Opening the audit log, looking up sources, and exporting are themselves events in the Audit log access area, with who did it, when, and from which address. Paging through the same list is recorded once, not for every page. A filter you type in is recorded only when it is an id or an action; anything else, such as an email address, is noted as a custom filter without its text.

For which sources fed an answer, see Where an answer's sources came from.