Organisation audit log

The audit log is the organisation’s provenance record for meaningful visible mutations. It is an append-only historical snapshot, not a live relational view.

Review an event

1. Open Organisation settings → Audit log.
2. Filter by event type or actor.
3. Expand an event to review its action time, resource identifiers, and safe metadata.

The log intentionally omits secrets, ABI bodies, calldata, signatures, and workflow variable values.

Agent provenance

An agent-created event shows:

• server-derived source: Agent API or MCP;
• the credential ID and name captured at the time;
• client-reported agent name and version; and
• a client-reported MCP host name and version when available.

These client labels help explain how a request arrived, but they are self-reported and do not authorize anything. The credential’s owning user remains the initiating user. When a wallet or Safe signer is the meaningful actor, the log preserves that signer as actor and records the credential as initiator provenance.

What is not audited

Reads, browser draft autosaves, background polling, profile/theme changes, and ordinary sign-in changes are intentionally excluded. Explicit agent mutations produce one attributable event; an idempotent replay returns the original result without adding another event.

If an event looks unfamiliar, verify the resource, revoke the relevant credential or membership, and inspect current wallet/Safe state.