Audit Log tab

Immutable record of every administrative change to the workspace — who changed what, when, and the before/after diff. Each row is one admin mutation: the actor (a user's email, or collector), a dotted action (rule.update, collector.approve, …), the target it touched, and a one-line summary. Expand a row for the full detail, including the structured diff.

This is not decision history. What agents did on the wire lives on Live Traffic — the live tail and the searchable decision archive in one page.

Filter by actor, action, target kind, free text, or since-date; the list is cursor-paginated ("Load older"). Export the loaded rows to CSV from the UI; JSON export is available via the API — see Export the audit log to a SIEM.

Screenshot: Audit Logdocs/public/screenshots/audit-log.png