Audit log

Every service that mutates state calls recordAudit() to append a row with the actor identity, action name (for example, "task.updated"), target (for example, "task:xyz"), and free-form context. Under impersonation the row is stamped with actingAs. This drives automations (when-then), exports (CSV and JSON), and compliance replays.

• BigInt autoincrement id, so ordering is unambiguous under concurrency
• Indexed by (tenantId, at), (tenantId, actorId), and (tenantId, action)
• Search UI with an action-prefix filter and an actor filter
• Feeds the automation engine and the webhook dispatcher

• Audit events are append-only; they are never mutated or deleted.
• The context JSON can carry arbitrary metadata, so keep PII out.
• Under super-admin impersonation, actingAs is stamped server-side and cannot be spoofed by the client.

1. 1Open /settings/audit-log.
2. 2Filter by an action prefix (for example, "task.") or by actor.
3. 3Export to CSV or JSON for external analysis.

Can an audit entry be edited or removed?

No. The log is append-only. Entries are never mutated and never deleted, which is what makes it usable as evidence rather than as a convenience.

Can I tell when somebody acted through impersonation?

Yes. The acting identity is stamped on the row by the server and cannot be set by the client, so an action taken while impersonating carries both the account it was taken as and the operator who took it.

Is it safe to put anything I like in the context field?

The context accepts arbitrary metadata, which means it will faithfully keep whatever you put there, including personal data you did not intend to retain. Keep personal data out of it and record identifiers instead.