Audit log — admin

Who opens it: an Owner answering "who changed this, and when?", or somebody working out what happened on the day.

What they came to do: find the write they are thinking of, and see what it changed.

True when they leave: they have the actor, the moment, the source and the before-and-after — or they know for certain that the thing they are looking for never happened.

Decisions already made

• Every write to a domain model is here. Not a convenience: it is a law (CLAUDE.md). A write reaches the database through a service, the service writes the audit row in the same transaction, and a Model::create() in a controller is a review failure.
• source says how it happened — ui, api, import, job, scanner, webhook, cli, platform — because "the roster changed" means something different when a person did it and when an import did. A PLATFORM row, shown in its own colour, is one EntryWick wrote about your organization — a plan set for a contract, a feature granted, a flag switched — with the operator's name on it and, where one was asked for, the reason. Nothing we do to your organization is missing from this screen.
• actor_type says who: a member, an API key, a device, or the system. A job acting for somebody records that person, so a scheduled send is not blamed on nobody.
• Before and after hold fillable fields only, minus anything hidden or encrypted, and never anything named like a secret. A token, a password, a DKIM key or a webhook secret does not appear in a log even by accident.
• Append-only. There is no edit and no delete on this screen, and there is no code path that writes one either.
• Scoped like everything else. A member sees their own organization's rows; a group-limited member sees the subtree's.

Open questions

• The filters are actor, action and date. "Everything that touched this registration" is the question people actually ask, and it needs a subject filter that understands relationships.
• Retention is the plan's data_retention_months, which quietly means an answer stops existing. Nothing on the screen says when.