Understand audit logging

What audit logging captures

Automation orchestrator captures the following activity:

• User-initiated actions — creating, modifying, or deleting workflows, credentials, users, and settings
• HTTP requests — every API request, including method, path, status code, actor, and response time
• Workflow lifecycle events — runs, completions, and failures
• Agent and large language model (LLM) interactions — invocation lifecycle, agent execution steps, and LLM API calls
• Security events — authentication attempts, authorization decisions, and session lifecycle

What audit logging does not capture

• LLM prompt and response content — automation orchestrator records only metadata about LLM interactions, such as the model identifier, interaction type, and outcome. Full prompt and response content is not stored.
• LLM token counts and latency metrics — audit events for LLM interactions do not include token usage counts (input tokens, output tokens) or request latency measurements. To monitor LLM cost and performance, use the metrics available from your LLM provider.
• Long-term event retention — automation orchestrator does not provide built-in storage for audit events beyond pod log retention. To retain events long-term, configure an external observability backend.

Audit events and operational logs

Automation orchestrator produces two distinct categories of log output, both written to pod standard output.

Audit events

Audit events record business-level activity: who performed an action, what changed, and when. Use audit events for compliance verification, security monitoring, and agent oversight. Audit events cover the following areas:

• User access events — authentication attempts, session lifecycle, and authorization decisions
• User change events — resource creation, modification, and deletion performed by human users or service accounts
• Agent activity — agent execution lifecycle, LLM API call metadata, tool invocations, and context planning
• Automation run events — workflow execution start, completion, failure, and node-level activity

Operational logs

Operational logs record infrastructure-level data: application server output, worker lifecycle, and request traces. Use operational logs for troubleshooting service errors, diagnosing resource exhaustion, and investigating connectivity failures. For details, see the operational log troubleshooting procedure in the related links.

Hard-delete lifecycle

Automation orchestrator uses a hard-delete model for resource lifecycle management. When you delete a resource such as a workflow, credential, or user, the platform permanently removes the resource from the database. The resource cannot be recovered after deletion.

Audit events that reference a deleted resource remain available in your observability backend for as long as your retention policy preserves them. However, the resource_name field in those events reflects the name at the time the event was recorded, and you cannot navigate from the event back to the deleted resource. Plan your audit review and export activities accordingly to maintain a complete audit trail.

Short-term retention and customer export responsibility

Automation orchestrator provides short-term retention for audit data. The platform writes audit events to pod standard output and, if configured, forwards them to an external observability backend through OpenTelemetry Protocol (OTLP). The platform does not provide long-term archival storage for audit data.

You are responsible for exporting audit data to external persistent storage before it is removed by retention policies. Data that exceeds the retention window is permanently deleted and cannot be recovered. If your organization requires long-term audit records for regulatory compliance, establish a recurring export schedule.

For retention window details and export procedures, see the related links.

Data protection

Automation orchestrator applies two data protection measures to audit events before they are emitted to your observability backend.

Sensitive field redaction

Automation orchestrator replaces fields with sensitive names, such as passwords, tokens, secrets, keys, credentials, certificates, and session identifiers, with [REDACTED]. It replaces email addresses in field values with [EMAIL_REDACTED]. Redaction applies to both snake_case and camelCase field names and runs on all structured event data.

Payload size limits

Each audit event is limited to 10,000 bytes of structured data. If an event exceeds this limit, automation orchestrator truncates the largest string values in the event payload, appending ...<truncated> to indicate the value was shortened. Event metadata fields such as actor, timestamp, and event type are not affected.