What Is an Audit Log?
In shortAn audit log is a record of who did what and when. See what an AI application should log, why metadata only is safer, and how 10xGraph emits audit events.
- 1 min read
- 5 sections
- Updated
- v1.0.0
- Markdown
An audit log is an append-only record of who did what, to which resource, when, and with what result. It answers questions after the fact: who read this thread, who deleted that file, who started this job.
Why does it matter for agents?
An agent server acts on behalf of users and can change data in many places. Metrics tell you how the system performs; an audit log tells you who acted. Auditors for frameworks such as SOC 2 and ISO 27001 ask for this kind of evidence.
What should it contain?
Keep the record small: the actor, the action, the resource id, the time and the outcome. Leave message content out. A log full of prompts and replies becomes another store of sensitive data that needs its own protection.
How does 10xGraph do it?
In 10xgraph-api, the audit key in 10xgraph.json turns on audit events with enabled, sinks (log, publisher or module:Class) and include_reads. Events go to the tenxgraph_api.audit logger, and LOG_FORMAT=json makes them machine-readable. 10xGraph emits the events and does not store them; retention and access control are yours. See the audit log guide.
Next steps
Frequently asked questions
- Does the audit log store prompts and replies?
- No. 10xGraph audit events carry metadata only, such as who, what action, which resource and the outcome. They hold no message content.
- Where is the audit log stored?
- Not in 10xGraph. It emits events to the sinks you configure, such as a logger or your publisher, and you keep and protect them in your own system.
- Is an audit log a compliance certificate?
- No. It is evidence you can show an auditor. 10xGraph is built for teams going through SOC 2 and ISO 27001 audits, and your own environment is what gets audited.