How do we set up audit logs and review agent actions?

Nothing to switch on. Every workspace records every action, approval decision, credential change, and admin operation to the audit_events table from day one. The log is append-only and cannot be edited from the dashboard.

Each row includes the actor (user, agent, or system), the action verb (action.executed, credential.rotated, approval.approved, etc.), the target entity, the before/after state, the source IP, and a timestamp. The format is OCSF-compatible so it can be shipped into a SIEM without re-mapping.

In the dashboard, Reports → Audit & Access surfaces the log with filters for actor, action, date range, and target. Approvals have their own view showing pending, resolved, and expired items alongside who reviewed each.

On any tier you can pull the log via the Audit API — paginated, filterable, and versioned. On Enterprise, streaming exports to Splunk, Datadog Cloud SIEM, or S3 are set up during onboarding, plus configurable retention beyond the default 90 days.

For SOC 2 evidence collection, the audit log satisfies the CC7 / CC8 control families out of the box. Ask us for the evidence-collection checklist during a Trust Center review.