Audit Log

Audit Log

Identity and access changes are recorded in the AuditLog table. The log is what turns "we changed a permission" into something an auditor can verify after the fact, and it is the companion evidence to the Exposure Register.

What is recorded

Actions are a closed vocabulary, defined in src/lib/rbac/audit.ts:

Action	Written when
role.create	A role is created
role.update	A role's permissions or metadata change
role.delete	A role is deleted
user.create	A user is created
user.role.assign	A user's role is changed
user.invite	An invitation is issued
user.invite.accept	An invitee completes signup
user.password.rotation_required	An administrator forces a password change
sso.provider.create	An identity provider is enrolled
sso.provider.update	Provider configuration changes
sso.provider.delete	A provider is removed
sso.domain.verify	A provider's email domain is verified

Entry shape

Each row carries the actor, the target, both sides of the change and the source IP:

Field	Meaning
companyId	Tenant the entry belongs to
actorUserId	Who did it. Nullable, and set to null if that user is later deleted, so history survives
action	One of the actions above
targetType / targetId	What was acted on
before / after	JSON snapshots of the state on each side
ip	Source address of the request
createdAt	Timestamp, indexed for reverse-chronological reads

before and after are stored as snapshots rather than as references, so a reviewer can see what changed without joining to a row that may since have been deleted.

Append-only

writeAudit in src/lib/rbac/audit.ts is the only writer, and there is no update or delete path anywhere in the codebase. Entries are removed only when the owning company is deleted, through the cascade.

Reading the log

GET /api/audit?take=50&skip=0

Requires the audit:read permission. Results are scoped to the caller's company, ordered newest first, and include the actor's email. take is clamped to 1..100 and defaults to 50. The response is { entries, total }, so total drives pagination.

Scope and limits

The log covers identity and access changes. It is not a general activity feed: alert triage, scans, dashboard edits and report exports are not written here. For outbound security telemetry, use the SIEM Integration feed instead.

Related

• Roles and Permissions for the permission model being audited
• Authentication for the sign-in paths that produce these actions
• Security for the wider control set