Audit records
Review security-sensitive requests, revisions, approvals, evidence access, and external delivery.
Audit records identify who requested a security-sensitive operation and how Guard evaluated it. They are distinct from traffic logs, endpoint observations, and an executor's execution result.
At Organization → Audit, filter by actor, resource ID, action, time, and outcome. Each record identifies the request, actor, targets, and authorization decision. Configuration changes include before/after revision references; asynchronous work includes its operation or action ID. Secret values and raw sensitive content are excluded.
Follow an action
Start with the request ID from a change or error. Link the audit decision to the operation, approval, and executor acknowledgement. An accepted request proves admission; a later failed action can coexist with that accepted audit entry. Rejected permission checks are recorded where the actor and organization can be identified safely.
Evidence reads, exports, unmasking, membership changes, policy publication, exception approval, response authorization, and credential rotation have their own records. A user's read access to a report does not imply permission to alter audit retention or export raw artifacts.
Export and integrity
Use Organization → Audit → Export with explicit time and resource scope. The bounded export includes a manifest and digest. Verify the exported digest before transferring it to an auditor and keep its collection cutoff with the report.
Organization users cannot edit individual audit entries. In a self-hosted installation, the infrastructure operator controls the database and storage; protect that boundary with separate administrative identities, backups, and an independently controlled external archive. A downloadable digest alone does not prevent a privileged infrastructure operator from changing both data and locally stored metadata.
Audit retention and deletion follow Organization → Data → Retention and any hold. Review evidence handling, integration exports, and recovery for their independent persistence boundaries.