The audit trail
Admin > Audit (with audit:read:admin, so administrators and owners only) is the read-only audit trail:
every privileged action and every sign-in, newest first, each with when it happened, who did it, the action,
and the resource. An action taken while impersonating shows the real administrator as the actor, with an
as <account> tag naming the principal whose identity they assumed (for example admin as bob), so
accountability lands on the human who acted and impersonation never hides them. A read-only user (a viewer) does not
see this page: the audit trail is admin-level information, so a plain “read everything” grant does not open it.
Failed sign-ins on a real account show as login failed (and a sign-in to a disabled account as login
denied), so you can spot a brute-force attempt; attempts on usernames that do not exist are not recorded.
The page uses the same faceted search as the inventory lists: filter by who, action, resource, or
id (type a term for a quick actor search, or action:login to pin a facet), and combine chips to narrow.
Filtering runs over the rows already loaded; Load older pages further back in time, so a search that comes
up short is a cue to load older and look deeper.
The Id column shows the resource’s friendly handle, resolved from the row’s own change images; hovering it reveals the stable uuid the trail actually stores, which is what keeps a row attributable after a rename. A row whose images carry no handle (an older registry delete) falls back to the raw id.
Pick a row to open its detail drawer: who acted (and, for an impersonated action, who was behind it), when, and the field-level before/after diff of the change itself. Changed fields highlight both sides, an added field only its After, a removed one only its Before, and unchanged fields dim. A create shows only After values and a delete only Before. Registry mutations record the full row on both sides (an update carries the row as it stood and as it became, a delete the whole row it removed); rows written before that shipped carried only an id, so an old row can still read one-sided. Auth events (sign-ins, password changes) record no row images at all, and the drawer says so. Sealed material never appears: a secret’s audit row carries its metadata only, and password changes record that the credential changed, never a value.
The model behind the trail, what is recorded and the dual-actor rule for impersonation, is identity and access and audit.