Read the Audit Log and Prove Who Changed What

• Read the four cards on the Audit tab
• Find who changed a policy, key, or credential
• Find out why requests are being blocked
• Export the log for a review

The card refreshes about every thirty seconds.

1. 1

   Open the Control Plane Audit Log

   It is on the lower right of the Audit tab.

2. 2

   Filter by action

   Choose an action, such as policy.update.

3. 3

   Search

   Type a policy name, key name, or person.

4. 4

   Open a row

   See the actor, the time, the target, and what changed.

1. 1

   Open Policy Violations

   Each row is a group: a reason, a policy, and an app.

2. 2

   Filter

   Type a reason, a policy, or an app to narrow the list.

3. 3

   Drill in

   Choose a group to see recent requests that match it.

4. 4

   Expand a request

   See the details the gateway recorded, such as the limit and what was requested.

• Findings that a guardrail allowed through, such as a secret in Observe
• Cases where a guardrail check could not run
• Approval bypasses

Filter by severity: Critical, Error, Warning, or Info. Routine guardrail activity is not recorded here, so the card stays short enough to read.

1. 1

   Open the Control Plane Audit Log

   Set the filter you need.

2. 2

   Choose Export

   The log downloads as a file.

3. 3

   Attach it

   Add it to the review, ticket, or evidence folder.

• Name policies, keys, and credentials so a row reads on its own
• Write a reason when you reject an approval
• Export the log monthly if your process needs a copy outside the console
• Review who holds the owner and admin roles each quarter

1. 1

   Approval queue

   Clear anything pending.

2. 2

   Policy Violations

   Look at the top groups. Fix the ones that block real work.

3. 3

   Bypass & Error Audit

   Read anything marked Error or Critical.

4. 4

   Control Plane Audit Log

   Scan policy, credential, and key changes for any you did not expect.