Two logs, not one
The shell records what happened to the workspace: sign-ins, invitations, role changes, module entitlement, access rules, billing. Modules record what happened to their own data: a posted journal entry, a sent envelope, a released part. That split follows the architecture — modules do not share a database, so they do not share a log.
| Question | Look in |
|---|---|
| Who added this person? | Shell — Admin → Audit log |
| Who gave them Accounting? | Shell — Admin → Audit log |
| Who posted this journal entry? | [Accounting → Audit trail](/docs/modules/accounting/journal-and-ledger) |
| Who sent this contract? | [Sign](/docs/modules/sign/envelopes) |
| Who changed this part? | [PLM](/docs/modules/plm/parts) |
| What did the AI cost us? | Shell — Admin → AI usage |
What the shell records
- Sign-in and sign-out, including which method was used.
- Invitations sent, accepted, and revoked.
- Role changes, with the old and new role.
- Module entitlement changes at the organisation level.
- Module access rules added and removed, with the note attached to them.
- API keys created and revoked.
- Billing plan changes.
- Organisation settings changes.
Audit log
Last 30 days
| When | Who | Event | Detail |
|---|---|---|---|
| Today 14:02 | Dana Okoro | module.access.removed | Tom Baird → finance ("not in finance") |
| Today 11:47 | Sam Whitfield | member.role.changed | Priya Raman: member → entity_admin |
| Yesterday 09:15 | Dana Okoro | org.module.enabled | sign |
| 3 Mar 16:30 | Dana Okoro | invitation.sent | [email protected] (member) |
| 2 Mar 08:02 | system | apikey.revoked | Old Zapier |
How AI actions are attributed
Where an agent proposed something and a person accepted it, both halves are recorded — what was suggested, and who took it. This matters more than it sounds. It means an agent is never the actor of record for a consequential change, and it means a review can distinguish "the model got this wrong" from "somebody accepted it without looking", which are different problems with different fixes.
Separately, Admin → AI usage attributes model spend per module per month. It is a cost surface rather than an audit surface, and it is worth a monthly glance for the same reason a phone bill is.
In Accounting, an agent can classify, match and propose. The posting itself is deterministic and is made by a person or a rule they configured. That is a deliberate constraint on the whole product, not an Accounting quirk.
Using it monthly
- Filter to role and access changes. Anything you cannot account for is a conversation.
- Check for sign-ins by people who have left.
- Check API key activity against the integrations you believe you have.
- Glance at AI usage for a shape change rather than a number.
What this does not do
The shell log does not include module events. You look in the module.
There is no webhook or syslog feed of audit events. Export is manual.
Retention is set by the platform and is not per-workspace.
Nothing notifies you when a sensitive event happens. Reading it is a habit, not a trigger.
Questions
Can members see the log?
No. Administrators only.
Can entries be edited or deleted?
No.
How far back does it go?
Longer than most reviews need. If you have a specific retention requirement, ask before relying on it.