The dual-lens model

The platform records every material action once, then renders it through a readable summary and an engineering view on the same page. A third lens, Auditor, renders a per-execution certificate and risk rubric for work item task flows and runs spawned from a work item today.

Audience: risk and compliance reviewers and IT (the enabler)

What gets recorded

Every action the platform takes against your data leaves an audit ledger entry. The ledger covers tool calls, file reads and writes, integration calls, runs, publishes, credential changes, configuration changes, prompt and response payloads, work item lifecycle events, and external triggers. Each entry carries an actor_id, occurred_at, family, direction, action, subject, request_id, and a four-valued status. Lineage links bind entries together so a run can be traced back to the work item, conversation, Project, or schedule that produced it.

The summary lens

The audit list lives at /audit. Each row shows Activity (actor, lead, secondary summary, origin badge, lineage chips), Surface (the Project or work item the action belongs to), Started (timestamp and duration), and Result (a status pill and a MetricLine showing counts of tools, requests, files, and entries). The summary is plain language: "Run completed", "Published Runbook", "Sent reply via Gmail", with the actor avatar and the surface lineage trail rendered next to it.

Click a row to open the detail page in place. The hero pins the surface, group id, status pill, lead, secondary summary, actor block, lineage trail, and a fact grid (Actor, When, Origin, Family, Direction, Action, Request, counts). This is the layer an auditor or analyst can read without engineering vocabulary.

The engineering lens

The detail page exposes a Details disclosure on each entry card. It opens by default. Inside, you see before state, after state, raw details JSON, tool stdout, prompt and response payloads, file diffs, and timing breakdowns. This is the layer an engineer uses to reproduce a bug or trace a tool call to a specific argument.

The engineering lens also exposes the entry timeline (entries grouped by minute), bulk Collapse all and Expand all toggles, and a Show debug toggle that reveals LLM reasoning and log emissions hidden from the default scan.

The status taxonomy is four-valued

Status is one of succeeded, failed, blocked, or degraded. They are not interchangeable, and triage paths differ:

Succeeded. The code path completed without error and produced its expected output.
Failed. The code path errored. Something the platform tried to do raised an exception. Engineering triage.
Blocked. A guardrail, approval gate, or missing credential held forward progress. Nothing errored; the platform refused to proceed. Policy or governance triage.
Degraded. Forward progress completed, but a secondary signal regressed (a downstream call timed out, a retry succeeded after failures, a partial result was returned). Observability triage.

Failed is not the same as blocked. Failed means a code path errored. Blocked means the platform refused to proceed under policy. The status pill tints differently (green for succeeded, red for failed, yellow for blocked, orange for degraded) and the triage owner is different. Do not collapse them in your control narrative.

Filtering and deep links

The audit page filters through the URL so any view is shareable. The contract:

?hours=1|24|168|720 selects the time window (1h, 24h, 7d, 30d). Default 24.
?view=all|conversations|work_items|data_work|tasks|runs|files|config selects the category.
?group=<group_id> opens the detail in place.
?actor=<actor_id> filters server-side to one actor. Used by the Users page View activity action.
?connection_id=<id> filters to a single data connection.

A second toolbar row exposes client-side filters: a free-text search across activity, actor, and request id; a "Failures only" checkbox (which includes failed, blocked, and degraded); and an actor dropdown built from the loaded rows.

The Auditor lens is partial today

The detail surface includes an Auditor tab in addition to Engineering. Today the Auditor lens renders only for work item task flows and runs spawned from a work item; it shows a certificate, a risk rubric, and processing steps. For every other group kind the Auditor tab is disabled with a "Soon" pill. Where you need a certificate today, sample on work item flows. The dual-lens summary and engineering views described above are available on every group kind regardless.

Audit and evidence Deterministic execution