Audit Event Log

Goal: Set up an append-only, hash-chained audit trail over workspace configuration commits, with server timestamps, user attribution, and server-side digest verification.

---

What is an Audit Event Log?

Aspect	Description
Purpose	Append-only, hash-chained record of workspace configuration-change events
Scope	Workspace-wide — captures events across all nodes
Compliance	Satisfies 21 CFR Part 11, EU Annex 11 audit trail requirements
Events captured	Create, Update, Delete, Scan, Transfer, Approve, Reject

---

Prerequisites

• Workspace admin permissions
• (Optional) Amendment Log for complete ALCOA+ coverage

---

Option A: Using the UI

Step 1: Add Audit Log to Workspace

1. Open workspace canvas
2. Find Audit Log in the Node Bank (shield icon, under Governance)
3. Drag onto canvas
4. Name it (e.g., "production-audit-trail")

Step 2: Configure Retention Policy

Open Inspector → Settings tab:

Field	Description	Default
Name	Display name	Required
Retention Period	How long events are kept	365 days
Export Format	Default export format	JSON

Step 3: Commit

Commit to activate the audit trail. Events begin capturing immediately.

Step 4: Browse Events

Click the Audit Log node → Inspector → Events tab:

Column	Description
Timestamp	Server-generated (UTC)
User	Who performed the action
Action	Create, Update, Delete, etc.
Entity Type	Connection, Surface, WarmQuery, etc.
Entity Key	Specific resource identifier

Step 5: Filter Events

Use the filter controls at the top of the Events tab:

Filter	Options
Entity Type	Connection, Surface, WarmQuery, App, etc.
Action Type	Create, Update, Delete, Approve, Reject
Date Range	Start date → End date
User	Specific user or "All"

Step 6: View Event Details

Click any event row to expand:

• Before state (JSON snapshot before the change)
• After state (JSON snapshot after the change)
• Diff view highlighting changed fields
• E-signature hash for verification

Step 7: Export for Compliance

Inspector → Events tab → Export button:

• CSV format (spreadsheet-friendly, includes all ALCOA+ fields)
• JSON format (machine-readable, includes full before/after payloads)

---

Option B: Ask Azi

Example prompts:

• "Add an audit log to this workspace"
• "Show me all delete events from last week"
• "Who modified the production-sensors connection yesterday?"
• "Export audit events from March 2026 as CSV"

---

Chain Verification

Every audit event carries a SHA-256 digest (Hash) computed by the platform over the stored record, chained to its predecessor. To check that a log has not been tampered with:

1. Inspector → Events tab → click event → Verify button
2. Or use the REST API: POST /oi-api/provenance/events/verify
3. The response reports ChainValid for the whole log, and Valid for one named record

Omit RecordID from the request and you verify the entire chain, genesis to tip — which is what a "verify this log" button does. See the REST API Reference for the full verdict shape, including why ChainValid: true with Empty: true means nothing was checked rather than everything is fine.

---

Best Practices

• Activate the audit log before other workspace changes to capture everything from the start
• Use Amendment Log alongside Audit Event Log for complete ALCOA+ coverage
• Export regularly for off-platform archival (compliance teams often require this)
• Set retention period based on your regulatory requirements (FDA: minimum 2 years; your organization may require longer)

---

Next Steps

If you want to...	Go to...
Document corrections with traceability	Amendment Log →
Query audit events via API	REST API → Audit Logs →
Understand ALCOA+ principles	Governance Overview →
Learn about workspace security	Security → Secrets →