Govern
Audit logs
An audit log is the durable record of who changed Mobius configuration, what they changed, and which credential they used.
Use audit logs for responsibility and change history: who edited a loop, granted a role, rotated a credential, or changed an integration. Use a run to understand what an executing process or agent did.
Audit history and run history
Mobius separates two questions:
| Question | Open |
|---|---|
| Who changed the configuration? | Audit logs |
| What did the runtime do with that configuration? | Run timeline or agent session |
This distinction keeps a 4 a.m. action call out of the configuration log and a permission change out of an execution timeline.
What an audit record tells you
Each record connects an action to:
- The person, API client, agent, or system that acted.
- The credential used to authenticate, when applicable.
- The resource that changed.
- The important before-and-after values.
- The project, organization, time, and request context.
Identity and credential are recorded separately. That lets you ask both “which workload acted?” and “which deployed key did it use?” after a key rotation.
Common reasons to use the log
During an incident, narrow the time window and look for the configuration change that preceded the symptom. During an access review, inspect role and credential changes. For everyday questions, filter to one resource to see whether a suspected edit actually happened.
Project audit logs show changes inside one workspace. Organization audit logs give administrators the cross-project view.
Inspect audit history in the app
Open Settings > Audit Logs inside a project. Filter by time, resource, action, or principal. Open Organization > Audit Logs when the question crosses project boundaries.
Records are append-only so the history remains trustworthy. If a producer captures information that should not be logged, fix the producer rather than treating history as editable content.
Use the CLI command reference for terminal queries and the interactive API reference for export or automated analysis.
Next
- Define what actors may do with roles.
- Separate workload identity from credentials with API clients and API keys.
- Inspect execution behavior with runs.