> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit Log

> Review the append-only record of every administrative change in your organisation - who did what, when, and from where.

Every administrative change in Ankra is recorded in the organisation **Audit Log**. It is the platform's system of record for governance questions: who invited that member, who approved that deployment, who accepted that CVE as risk, and when.

***

## What is recorded

Each entry captures:

* **Who** - the actor (a member, or a token acting on their behalf)
* **What** - the action and the resource it touched, with structured details of the change
* **When** - the timestamp
* **Where from** - the source IP

Administrative changes across the platform write entries: invitations and role assignments, cluster-group edits, credential changes, cluster lifecycle operations, security disposition changes, and organisation settings edits.

Entries are **append-only** - they cannot be edited or deleted - and they are written for every change regardless of who can view the log.

***

## Who can see it

Viewing the audit log requires the audit read permission, held by **owners** and **admins** by default. It can also be granted to [custom roles](/guides/roles-and-access), so a compliance or security function can review the log without broader administrative access.

***

## Reading and filtering

Open **Organisation → Settings → Audit Log**. From there you can:

* **Search** entries by keyword
* **Filter** by user, action type, resource type, and date range
* **Expand** an entry to see the structured details of the change

***

## Exporting

Export of the current filtered view to CSV or JSON is rolling out. If you do not see the export action yet, it is on its way to your organisation.

***

## Retention

Audit entries are currently retained without a fixed expiry. A 12-month standard retention window is being introduced; entries inside the window are immutable.

***

## Relationship to Git history

Ankra gives you two complementary trails:

* The **audit log** records platform actions - who signed in, assigned a role, approved a plan, or changed a disposition.
* **Git history** records desired-state changes as attributed commits - exactly what changed in your cluster definitions and Stacks, and when it was deployed.

Together they answer both "who did what in the platform" and "what actually changed in the cluster". For how commits are produced and attributed, see [GitOps](/concepts/gitops).

***

## Related

<CardGroup cols={2}>
  <Card title="Roles & Access" icon="user-shield" href="/guides/roles-and-access">
    Grant the audit read permission via custom roles.
  </Card>

  <Card title="GitOps" icon="git-alt" href="/concepts/gitops">
    The attributed commit trail for desired-state changes.
  </Card>

  <Card title="Security at Ankra" icon="shield-halved" href="/security/overview">
    How the audit log fits the wider control set.
  </Card>

  <Card title="Cluster Security" icon="bug" href="/guides/cluster-security">
    Disposition changes that land in the audit log.
  </Card>
</CardGroup>