Audit log viewer

What it is

A read surface over the audit_log table: every privileged action in the workspace, filterable by action name, actor, and date window, with a one-click CSV export shaped for an auditor’s spreadsheet.

Distinct from the roles + audit doc which covers the role model itself; this is the viewer: the page you open when SOC2 asks “show me every change to access control last quarter.”

What it produces

Per row:

• When: UTC timestamp.
• Actor: email of the user who performed the action; system for un-attributed actions (e.g. scheduler jobs).
• Action: namespaced verb (target.delete, agent.revoke, billing.checkout.topup, …). Colour-coded by namespace so target / agent / billing / org actions stand out.
• Target: the affected entity’s identifier (target id, channel id, user id, …).
• Detail: JSONB blob with the full request payload. Click any row to expand it inline.

Plus:

• CSV export: RFC 4180 with five columns: timestamp_utc, actor_email, action, target, detail_json. Capped at 50,000 rows per export.

What to use it for

• SOC 2 / ISO 27001 audits: “every change to access control in the last quarter”. Pick the date range, filter by org.member.* or target.*, export CSV.
• Incident response: “who triggered this AI run?” Search by target id or action name.
• Forensics: every privileged action has the full JSON detail of the request, so reconstructing what changed is trivial.

Why it matters

The data was always there. Every s.audit() call has been writing rows since v1. What was missing was a read surface that didn’t require psql access. This is the artifact a procurement team expects to see in a security review; no more screenshots of SQL output.

Why it’s valuable

• Org-scoped by design. Each row’s org_id is matched against the caller’s org. You only see your own workspace’s log. Super-admin (Umbra staff) cross-tenant rows are hidden.
• org_admin-gated. Privileged log of privileged actions, not visible to org_viewer or org_member.
• Action dropdown is populated from real data. The filter shows only actions that actually exist in your org, not a generic exhaustive list.
• CSV cap is a feature. An audit log running for years accrues hundreds of thousands of rows; an auditor never needs all of them in one CSV.

How to use it

• Open Audit log in the left nav (under the ADMIN section).
• Default view: last 90 days, all actions, paginated 50/page.
• Filter: search box (substring match on action OR target), action dropdown, from / to date pickers. Page resets to 1 on every filter change.
• Click any row → JSON detail expands inline.
• Export CSV → browser downloads umbra-audit-YYYY-MM-DD.csv with the current filter applied.