Authorization audit events
Automation orchestrator emits audit events for authorization management operations. These events are categorized as security_event and are written to pod standard output and, when configured, forwarded to an external OTLP-compatible observability backend.
Automation orchestrator does not emit audit events for individual policy evaluations (per-request authorization decisions). It audits authorization management operations such as role assignments and role lifecycle changes.
Role assignment events. Automation orchestrator records an audit event each time you assign or revoke a role for a user or group. Each event includes the assignment ID, principal type and ID, role name, and project scope. Automation orchestrator logs failed operations at error severity.
Role lifecycle events. Automation orchestrator records an audit event when you create, update, or delete a role. When you delete a role, the event includes the count of cascade-deleted role assignments (affected_assignments_count). Automation orchestrator logs deletion of a role with active assignments at warning severity.
Example: filter authorization events from pod logs
To find role assignment events in the pod log output:
$ oc logs deployment/cr-name-backend -n namespace | \
jq 'select(.event_category == "security_event" and .event_action == "role_assigned")'If you have configured OTLP forwarding, query your observability backend for events where event_category = security_event.
Each event type includes structured data fields that describe the operation.