# What Is an Audit Log?

> An audit log is a record of who did what and when. See what an AI application should log, why metadata only is safer, and how 10xGraph emits audit events.

Source: https://10xgraph.com/docs/glossary/what-is-an-audit-log
Last updated: 2026-11-10

**An audit log is an append-only record of who did what, to which resource, when, and with what result.** It answers questions after the fact: who read this thread, who deleted that file, who started this job.

## Why does it matter for agents?

An agent server acts on behalf of users and can change data in many places. Metrics tell you how the system performs; an audit log tells you who acted. Auditors for frameworks such as SOC 2 and ISO 27001 ask for this kind of evidence.

## What should it contain?

Keep the record small: the actor, the action, the resource id, the time and the outcome. Leave message content out. A log full of prompts and replies becomes another store of sensitive data that needs its own protection.

## How does 10xGraph do it?

In `10xgraph-api`, the `audit` key in `10xgraph.json` turns on audit events with `enabled`, `sinks` (`log`, `publisher` or `module:Class`) and `include_reads`. Events go to the `tenxgraph_api.audit` logger, and `LOG_FORMAT=json` makes them machine-readable. 10xGraph emits the events and does not store them; retention and access control are yours. See the [audit log guide](/docs/server/audit-log).

## Next steps

- [Audit log](https://10xgraph.com/docs/server/audit-log): Configure sinks and read events.
- [Tenancy and access](https://10xgraph.com/docs/concepts/tenancy-and-access): The identity an event records.
- [Events and observability](https://10xgraph.com/docs/concepts/events-and-observability): Publishers, metrics and tracing.

## Frequently asked questions

### Does the audit log store prompts and replies?

No. 10xGraph audit events carry metadata only, such as who, what action, which resource and the outcome. They hold no message content.

### Where is the audit log stored?

Not in 10xGraph. It emits events to the sinks you configure, such as a logger or your publisher, and you keep and protect them in your own system.

### Is an audit log a compliance certificate?

No. It is evidence you can show an auditor. 10xGraph is built for teams going through SOC 2 and ISO 27001 audits, and your own environment is what gets audited.