You can use the audit trail to monitor platform activity and support compliance. User actions, workflow executions, agent interactions, and security changes produce durable audit events visible in the Audit UI. Low-level database change events are available through the OTLP channel only.

Automation orchestrator records business-level activity as structured audit events. Nine event categories cover the full scope of platform activity, from user-initiated changes to AI agent behavior.

Audit events are produced from three origins, identified by the audit.event_source field:

• business_event — application-level instrumentation that records user actions, agent execution, and settings changes. These events are stored in the platform database and visible in the Audit UI.
• security_event — application-level instrumentation specific to security-relevant operations: authentication outcomes, authorization decisions, session lifecycle, and role assignments. These events are stored in the platform database and visible in the Audit UI.
• crud_event — database triggers that automatically capture every create, update, and delete operation on audited tables. At GA, crud_event data is forwarded to the OTLP channel only and does not appear in the Audit UI.

Note

The outbox pattern provides at-least-once delivery guarantees. Duplicate audit events may occur during network partitions or OTLP endpoint recovery. De-duplicate by event_id when ingesting events into external systems.

Operational logs are distinct from audit events. Use audit events for compliance and security monitoring. Use operational logs for infrastructure troubleshooting and incident diagnosis.

Automation orchestrator uses a hard-delete model. The audit trail is the only durable record of deleted resources. For multi-year compliance retention, export audit data to external storage before the platform retention window expires.