Authorization audit events

Automation orchestrator emits audit events for authorization management operations, including role assignments and role lifecycle changes. These events are categorized as security_event and stored in the platform database and, when configured, forwarded to an external OTLP-compatible backend.

Audit event categories
Copy link

Authorization audit events belong to the security_event category. This category covers security-relevant operations that require durable audit records for compliance purposes. All security_event records are stored in the platform database and are visible in the Audit UI:

Category Description Storage
security_event Security-relevant operations: authentication, authorization management, session lifecycle, role assignments. Stored in the platform database and visible in the Audit UI. Database + OTLP
Note

This reference covers authorization management operations: role assignments and role lifecycle changes. Per-request authorization denials (authorization_denied events) are documented in the authentication audit events reference. Automation orchestrator does not emit audit events for individual policy evaluations beyond the authorization_denied event at the request level.

Role assignment events
Copy link

Automation orchestrator records a security_event audit event each time a role is assigned to or revoked from a user, service account, or group. The following two role assignment events are supported at the 2026-8 GA release:

Event action Trigger Severity Additional fields Notes
role_assigned A role is assigned to a user, service account, or group Critical resource_urn: urn:syntara:role-assignment:{id}; role_id; assignee_id Critical severity reflects that privilege escalation is a security-sensitive operation requiring immediate audit visibility.
role_revoked A role assignment is removed from a user, service account, or group Warning resource_urn: urn:syntara:role-assignment:{id}; role_id; assignee_id assignee_id identifies the user, group, or service account from which the role was removed.

Role lifecycle events
Copy link

Automation orchestrator records a security_event audit event for role definition changes. The following three role lifecycle events are supported at the 2026-8 GA release:

Event action Trigger Severity Additional fields
role_created A new custom role definition is created Info resource_urn: urn:syntara:role:{id}; role_id
role_updated An existing role definition is modified Warning resource_urn: urn:syntara:role:{id}; role_id
role_deleted A role definition is permanently deleted Warning resource_urn: urn:syntara:role:{id}; role_id

Filter examples
Copy link

To find all security events in pod log output:

$ oc logs deployment/orchestrator-deployment-name -n namespace --since=1h | \
    jq 'select(.event_category == "security_event")'

To find role assignment events and display them as structured JSON:

$ oc logs deployment/orchestrator-deployment-name -n namespace --since=1h | \
    jq 'select(.event_category == "security_event" and .event_action == "role_assigned")'

To find all role lifecycle changes in a specific time window:

$ oc logs deployment/orchestrator-deployment-name -n namespace --since=24h | \
    jq 'select(.event_category == "security_event" and (.event_action | startswith("role_")))'

To find authorization denied events:

$ oc logs deployment/orchestrator-deployment-name -n namespace | \
    jq 'select(.event_action == "authorization_denied")'