Skip to main content
Open Audit log from the PlainRouter sidebar to review chronological security and Actions history for the current workspace.

​
What an audit event contains

Each event records:
  • Event type and plain-language summary.
  • Actor type and actor name.
  • Related batch and action, when applicable.
  • Structured event payload and creation time.
  • Event hash, previous hash, and hash version.
Events are append-only and predecessor-linked within the current database snapshot.

​
Integrity versions

The top of the audit page reports separate integrity segments:
The hash chain has no external tail anchor. Successful v2 recomputation detects changed stored rows within the current snapshot, but it cannot independently prove that no tail events were deleted outside that snapshot.
Expand Integrity details on an event to see its version, hash, and predecessor hash.

​
Events to follow

Measurement-only events explicitly say NOT LANDED. Do not count them as production execution acceptance.

​
Investigate unexpected execution

1

Confirm the principal and scope

Find batch.proposed. Confirm the agent, account, evidence provenance, target-selection boundary, and execution-mode snapshot.
2

Trace both policy decisions

Read the proposal-time result and, for executable work, the execution-time result recorded before the provider call.
3

Confirm the human decision

Find the approval or rejection event and confirm the named person and time.
4

Follow the receipt evidence

Trace execution, raw provider observations, classifications, and terminal verification. An awaiting-verification event is not Landed.
5

Confirm restoration when needed

For failed work, find the compensation and provider-read proof. Escalate any rollback_incomplete event.
6

Revoke access if necessary

Revoke the PlainRouter agent connection or workspace token. Revocation disables its principal and associated credential.