# Read the audit log

> Source: https://elaichi.ai/docs/guides/governance/read-the-audit-log/

The audit log is an append-only record of privileged actions in your organization — who did what, to which resource, and when.

**Where to find it:** **Governance → Audit logs**

You need the **Read audit log** permission (`audit:read`). Built-in **Org Owner** and **Org Admin** include it; **Team Admin**, **Member**, and **Viewer** do not.

The log records meaningful changes and tool calls — not every page view.

## What gets recorded

From the product surface, expect coverage across:

| Area | Examples of what’s captured |
| --- | --- |
| **Membership & access** | Invites, member role changes, removals, roles, teams, restrictions, SSO/SCIM changes |
| **Connections** | Connect, reconnect, transfer, delete (including transfers during offboarding) |
| **Connectors** | Custom connector authoring and related changes |
| **Toolboxes** | Create/update/share and related toolbox activity; synthetic tools |
| **MCP** | Server lifecycle and `mcp.tool_called` (tool, connection, status, duration) |
| **Assistant** | Provider key changes and other assistant admin actions |
| **Organization** | Org/team/billing-class events |
| **Logging** | Observability destination configuration |

Each entry typically includes the **actor**, **action**, **resource**, **time**, and **metadata** you can open for full detail.

## Categories in the UI

The Audit logs tab groups events for filtering:

| Category | What it groups |
| --- | --- |
| **Assistant** | Assistant-related actions |
| **MCP** | MCP servers and tool calls |
| **Toolboxes** | Toolboxes and synthetic tools |
| **Connections** | Connections and connectors |
| **Access** | Members, invites, roles, SSO/SCIM, restrictions |
| **Org** | Organization, teams, billing-class events |
| **Other** | Anything that doesn’t match the above |

## Find an event

1. Open **Governance → Audit logs**.
2. Use **search** for an action name, actor, resource, or metadata text.
3. Narrow with the **type** filter (the categories above). Counts show how many loaded events fall in each bucket.
4. Select a row for the full detail panel.

**You'll know it worked when:** You can explain what changed, who changed it, and when.

Filters and search sync into the URL (`q`, `category`) so you can bookmark or share a view. Refresh reloads the log from the server.

## Forward events elsewhere

To send classified events (`tool_call` / `auth` / `admin`) to your own observability stack, configure destinations under **Settings → Logging** (permission `logging:manage`). Datadog delivery is supported; see [Forward audit events](/guides/settings/logging).

## Good to know

- The log is **append-only** and scoped to the current organization.
- MCP tool calls are audited even when they succeed — useful when investigating what an agent actually ran.
- Retention and which advanced logging features you get depend on your plan; workspace audit access itself is part of the standard Gold/Black workspace feature set.

## Related

- [Set connector and tool restrictions](/guides/governance/set-restrictions)
- [Forward audit events](/guides/settings/logging)
- [Roles and permissions](/guides/members/roles)