Audit Trails
Every action on the Clevername platform is logged with a tamper-evident hash chain. Search, filter, and export audit records for compliance, incident investigation, or routine review.
What gets logged
Every API call, tool invocation, content scan, auth event, config change, and emergency control activation is recorded as an audit entry. Each entry includes:
- Timestamp, user ID, and IP address.
- Action type and target resource.
- Request and response metadata. Payload content is not stored by default.
- A cryptographic hash linking to the previous entry (hash chain).
How much detail is captured
Content capture is a platform-wide setting, not a per-agent one. The default is metadata only: prompts, responses, and tool arguments and results are not written to storage at all. A guardrail profile can carry a compliance audit mode as a descriptor of the framework it was compiled for, but nothing keys off it per agent — changing it does not change what is stored.
Hash chain verification
Each audit entry contains a SHA-256 hash that incorporates the previous entry's hash, creating a tamper-evident chain. Verification recomputes every entry's hash from its content, checks its HMAC signature, and confirms each entry links to a present predecessor — so modifying a retained entry, forging an entry, or deleting one from inside the chain fails verification. Removal of the newest entries or of an entire user's history is outside what chain verification alone can prove; forward events to your SIEM (below) if you need an independent copy for that case.
Navigate to Audit Trails
Open Audit Logs at /dashboard/audit (also reachable under Agents → Audit). There is no Audit tab inside the Security section. The default view shows the most recent 24 hours of activity.
Search and filter entries
Use the search bar to find entries by action type, user, resource, or free text. Apply filters to narrow by:
- Time range — Last hour, 24h, 7 days, 30 days, or custom range.
- Action type — API call, tool invocation, auth event, config change, etc.
- User — Filter to a specific user or agent.
- Severity — Info, warning, error, critical.
Inspect an entry
Click any row to expand the entry detail panel. By default you see the action summary without payload content, because content is not stored. Where content logging is enabled platform-wide, the payloads appear here — decrypted in your browser after you enter your passphrase if you have I/O encryption on.
Verify the hash chain
Click Verify Chain to run an integrity check across a range of entries. The system recomputes each hash and confirms the chain is unbroken. A green checkmark confirms integrity; a red flag indicates tampering.
Export audit data
Click Export to download audit entries as CSV or JSON. Apply filters first to export a specific subset. Exports include the hash chain values for offline verification.
Retention policy
Retention is set by plan: 7 days on Free, 30 days on Pro, 365 days on Team, and unlimited on Enterprise. An organization-level override (audit_retention_days in org settings) takes precedence over the plan default when set. The guardrail profile's retention_days field is descriptive only — the purge job does not read it.