Backed by: @pithy-sh/audit. Scopes: audit:events:read · audit:events:read_detail.
Free covers this in full
The pane reads the audit capability’s own trail in your database: the event model is what a row is, actors is who caused it, and retention is how long it stays.
The full audit trail is visible on every plan, with no time limit.
Two scopes, because two reads disclose different things
The listing answers who did what, when, and whether it worked. It carries no network identifier and no capability payload.
The single-event read additionally returns IP, user-agent and metadata — the trail’s personal data, and the bag capabilities write addresses and resource names into.
Bulk-harvesting those is a privacy incident, so it takes a grant you make deliberately.
And because they are separate routes, a credential with only the detail scope cannot enumerate the trail to find ids, and one with only the listing scope cannot resolve one.
Filter on what you actually ask
Actor and actor type · action · outcome · severity · resource · origin · tenant · a time range.
actorType: "control-plane" is what separates a management client’s actions from your own users’ — which is the question this surface is really asked.
tenant: null is a filter, not an absence
| Omitted | Do not filter by tenant |
null | The events that belong to no tenant |
A CLI-originated action, a fleet-wide operator action, a row written before the column existed — all genuinely have no tenant, and show me those is a question adopters ask.
Outcome and severity are separate axes
denied is first class. Blocked attempts are recorded, not only successes — a trail of things that worked cannot show you somebody trying.
Severity is orthogonal. A successful production secret rotation is critical; a mistyped code is routine. Neither axis predicts the other.
Pages are keyset, never offset
The trail is appended to while it is being read.
An offset page silently skips records — and on a security trail that is a record you never see, not a cosmetic glitch.
Reading is audited
Including the reads that found nothing.
Yes, that appends to the table it just read. A surface that exempted itself from the guarantee it provides would be worth less than the row it saves.
Nothing here writes
No delete, no edit, no retention control.
A management credential that could erase an audit row could erase the evidence of its own use.