Audit log
Who changed what, and every tool call the agent made, for your organization.
Who can: Owners, Admins, SREs and Managers.
The Audit log records, with the person (or scheduler) and the time:
| Area | Events |
|---|---|
| Agent | every tool call (agent.tool_call), with its input and run |
| MCP servers | created, tested, activated, disabled, deleted, secret rotated, access changed |
| Tools | discovered, reviewed (approved and revoked, by name), changed by the server (mcp.tools.drift_detected) |
| OAuth | sign-in started, connected, failed, disconnected |
| Reports | schedule created, paused, deleted; each run, manual or scheduled |
| People | organization created, member added, role changed |
Use it to answer what did the agent look at during last night's incident? or who approved this tool?