Audit Log catalogue

Scrydon accepts only actions and resource types in this catalogue. The page is rendered from the same registry used by server validation, so an event value cannot be accepted without appearing here.

See Audit logging for retention, export, Log Receiver forwarding, and the common envelope carried by every event type.

Audit actions

Authorization entries cover every combination of action (read, write, delete, execute, admin, retire) and outcome (GRANTED, DENIED, INDETERMINATE). One decision produces one entry. The evaluated subject is stored in the bounded decision evidence, while producer identifies the authenticated Scrydon workload that submitted it.

Action	Registry key	Family	Description	Status
SECRET_CREATE	SECRET_CREATE	extension	Records secret create.	Active
SECRET_UPDATE	SECRET_UPDATE	extension	Records secret update.	Active
SECRET_DELETE	SECRET_DELETE	extension	Records secret delete.	Active
SECRET_ACCESS	SECRET_ACCESS	extension	Records secret access.	Active
PROVIDER_CREATE	PROVIDER_CREATE	extension	Records provider create.	Active
PROVIDER_UPDATE	PROVIDER_UPDATE	extension	Records provider update.	Active
PROVIDER_DELETE	PROVIDER_DELETE	extension	Records provider delete.	Active
PROVIDER_TEST	PROVIDER_TEST	extension	Records provider test.	Active
CUSTODY_CHANGED	CUSTODY_CHANGED	security	Records custody changed.	Active
CUSTODY_REENCRYPT_PROGRESS	CUSTODY_REENCRYPT_PROGRESS	security	Records custody reencrypt progress.	Active
CUSTODY_VERIFY_REVOCATION	CUSTODY_VERIFY_REVOCATION	security	Records custody verify revocation.	Active
RESOURCE_CREATE	RESOURCE_CREATE	data	Records resource create.	Active
RESOURCE_UPDATE	RESOURCE_UPDATE	data	Records resource update.	Active
RESOURCE_DELETE	RESOURCE_DELETE	data	Records resource delete.	Active
RESOURCE_ACCESS	RESOURCE_ACCESS	data	Records resource access.	Active
ontology.entity.changed	ONTOLOGY_ENTITY_CHANGED	operations	Records ontology entity changed.	Active
ontology.effect.requested	ONTOLOGY_EFFECT_REQUESTED	operations	Records ontology effect requested.	Active
ontology.materialization-cursor.resumed	ONTOLOGY_MATERIALIZATION_CURSOR_RESUMED	operations	Records ontology materialization cursor resumed.	Active
AUTH_READ_DENIED	AUTH_READ_DENIED	authorization	Records auth read denied.	Active
AUTH_WRITE_DENIED	AUTH_WRITE_DENIED	authorization	Records auth write denied.	Active
AUTH_DELETE_DENIED	AUTH_DELETE_DENIED	authorization	Records auth delete denied.	Active
AUTH_EXECUTE_DENIED	AUTH_EXECUTE_DENIED	authorization	Records auth execute denied.	Active
AUTH_ADMIN_DENIED	AUTH_ADMIN_DENIED	authorization	Records auth admin denied.	Active
AUTH_RETIRE_DENIED	AUTH_RETIRE_DENIED	authorization	Records auth retire denied.	Active
AUTH_READ_GRANTED	AUTH_READ_GRANTED	authorization	Records auth read granted.	Active
AUTH_WRITE_GRANTED	AUTH_WRITE_GRANTED	authorization	Records auth write granted.	Active
AUTH_DELETE_GRANTED	AUTH_DELETE_GRANTED	authorization	Records auth delete granted.	Active
AUTH_EXECUTE_GRANTED	AUTH_EXECUTE_GRANTED	authorization	Records auth execute granted.	Active
AUTH_ADMIN_GRANTED	AUTH_ADMIN_GRANTED	authorization	Records auth admin granted.	Active
AUTH_RETIRE_GRANTED	AUTH_RETIRE_GRANTED	authorization	Records auth retire granted.	Active
AUTH_READ_INDETERMINATE	AUTH_READ_INDETERMINATE	authorization	Records auth read indeterminate.	Active
AUTH_WRITE_INDETERMINATE	AUTH_WRITE_INDETERMINATE	authorization	Records auth write indeterminate.	Active
AUTH_DELETE_INDETERMINATE	AUTH_DELETE_INDETERMINATE	authorization	Records auth delete indeterminate.	Active
AUTH_EXECUTE_INDETERMINATE	AUTH_EXECUTE_INDETERMINATE	authorization	Records auth execute indeterminate.	Active
AUTH_ADMIN_INDETERMINATE	AUTH_ADMIN_INDETERMINATE	authorization	Records auth admin indeterminate.	Active
AUTH_RETIRE_INDETERMINATE	AUTH_RETIRE_INDETERMINATE	authorization	Records auth retire indeterminate.	Active
EXECUTION_GRANT_CREATED	EXECUTION_GRANT_CREATED	authorization	Records execution grant created.	Active
EXECUTION_GRANT_REJECTED	EXECUTION_GRANT_REJECTED	authorization	Records execution grant rejected.	Active
EXECUTION_GRANT_BOUND	EXECUTION_GRANT_BOUND	authorization	Records execution grant bound.	Active
EXECUTION_GRANT_DERIVED	EXECUTION_GRANT_DERIVED	authorization	Records execution grant derived.	Active
EXECUTION_GRANT_VALIDATED	EXECUTION_GRANT_VALIDATED	authorization	Records execution grant validated.	Active
EXECUTION_GRANT_REVOKED	EXECUTION_GRANT_REVOKED	authorization	Records execution grant revoked.	Active
EXECUTION_GRANT_EXPIRED	EXECUTION_GRANT_EXPIRED	authorization	Records execution grant expired.	Active
AUTHORIZATION_CONTEXT_CREATED	AUTHORIZATION_CONTEXT_CREATED	operations	Records authorization context created.	Active
AUTHORIZATION_CONTEXT_REAUTHORIZED	AUTHORIZATION_CONTEXT_REAUTHORIZED	operations	Records authorization context reauthorized.	Active
AUTHORIZATION_CONTEXT_RESOLVED	AUTHORIZATION_CONTEXT_RESOLVED	operations	Records authorization context resolved.	Active
AUTHORIZATION_CONTEXT_REJECTED	AUTHORIZATION_CONTEXT_REJECTED	operations	Records authorization context rejected.	Active
AUTHORIZATION_CONTEXT_REVOKED	AUTHORIZATION_CONTEXT_REVOKED	operations	Records authorization context revoked.	Active
AUTHORIZATION_CONTEXT_EXPIRED	AUTHORIZATION_CONTEXT_EXPIRED	operations	Records authorization context expired.	Active
authz.audit.policy.updated	AUTHZ_AUDIT_POLICY_UPDATED	authorization	Records authz audit policy updated.	Legacy read-only
isolation.policy.updated	ISOLATION_POLICY_UPDATED	authorization	Records isolation policy updated.	Active
llm_router.routes.updated	LLM_ROUTER_ROUTES_POLICY_UPDATED	authorization	Records llm router routes updated.	Active
voice.on_device_speakers.updated	VOICE_ON_DEVICE_SPEAKERS_POLICY_UPDATED	authorization	Records voice on device speakers updated.	Active
credential_policy.updated	CREDENTIAL_POLICY_UPDATED	authorization	Records credential policy updated.	Active
capability.policy.updated	CAPABILITY_POLICY_UPDATED	authorization	Records capability policy updated.	Active
capability.policy.refused	CAPABILITY_POLICY_REFUSED	authorization	Records capability policy refused.	Active
data_source.auto_pause.updated	DATA_SOURCE_AUTO_PAUSE_POLICY_UPDATED	authorization	Records data source auto pause updated.	Active
ontology.watch.execution_accounts.updated	ONTOLOGY_WATCH_EXECUTION_ACCOUNTS_POLICY_UPDATED	authorization	Records ontology watch execution accounts updated.	Active
AGENT_EXECUTION_ISOLATION_RELAXED	AGENT_EXECUTION_ISOLATION_RELAXED	operations	Records agent execution isolation relaxed.	Active
EXTENSION_ENTITLEMENT_MODE_CHANGE	EXTENSION_ENTITLEMENT_MODE_CHANGE	authorization	Records extension entitlement mode change.	Active
EXTENSION_ENTITLEMENT_GRANT	EXTENSION_ENTITLEMENT_GRANT	authorization	Records extension entitlement grant.	Active
EXTENSION_ENTITLEMENT_REVOKE	EXTENSION_ENTITLEMENT_REVOKE	authorization	Records extension entitlement revoke.	Active
EXTENSION_ENTITLEMENT_UPDATE	EXTENSION_ENTITLEMENT_UPDATE	authorization	Records extension entitlement update.	Active
EXTENSION_ACCESS_DENIED	EXTENSION_ACCESS_DENIED	extension	Records extension access denied.	Active
EXTENSION_CREDENTIAL_RESOLVED	EXTENSION_CREDENTIAL_RESOLVED	extension	Records extension credential resolved.	Active
preset.secret.released	PRESET_SECRET_RELEASED	security	Records preset secret released.	Active
preset.secret.refused	PRESET_SECRET_REFUSED	security	Records preset secret refused.	Active
preset.secret.sealed	PRESET_SECRET_SEALED	security	Records preset secret sealed.	Active
EXTENSION_UPGRADED	EXTENSION_UPGRADED	extension	Records extension upgraded.	Active
EXTENSION_ROLLED_BACK	EXTENSION_ROLLED_BACK	extension	Records extension rolled back.	Active
EXTENSION_ENABLE	EXTENSION_ENABLE	extension	Records extension enable.	Active
EXTENSION_DISABLE	EXTENSION_DISABLE	extension	Records extension disable.	Active
EXTENSION_DEPRECATE	EXTENSION_DEPRECATE	extension	Records extension deprecate.	Active
EXTENSION_CANCEL_DEPRECATION	EXTENSION_CANCEL_DEPRECATION	extension	Records extension cancel deprecation.	Active
acs.decision.recorded	ACS_DECISION_RECORDED	operations	Records acs decision recorded.	Active
acs.decision.denied	ACS_DECISION_DENIED	operations	Records acs decision denied.	Active
collaboration.output.admitted	COLLABORATION_OUTPUT_ADMITTED	operations	Records collaboration output admitted.	Active
collaboration.output.denied	COLLABORATION_OUTPUT_DENIED	operations	Records collaboration output denied.	Active
collaboration.admission.denied	COLLABORATION_ADMISSION_DENIED	operations	Records collaboration admission denied.	Active
collaboration.workspace_channel.create	COLLABORATION_WORKSPACE_CHANNEL_CREATE	operations	Records collaboration workspace channel create.	Active
collaboration.workspace_channel.rename	COLLABORATION_WORKSPACE_CHANNEL_RENAME	operations	Records collaboration workspace channel rename.	Active
collaboration.workspace_channel.archive	COLLABORATION_WORKSPACE_CHANNEL_ARCHIVE	operations	Records collaboration workspace channel archive.	Active
collaboration.org_channel.create	COLLABORATION_ORG_CHANNEL_CREATE	operations	Records collaboration org channel create.	Active
collaboration.org_channel.update	COLLABORATION_ORG_CHANNEL_UPDATE	operations	Records collaboration org channel update.	Active
collaboration.org_channel.members_add	COLLABORATION_ORG_CHANNEL_MEMBERS_ADD	operations	Records collaboration org channel members add.	Active
collaboration.org_channel.member_remove	COLLABORATION_ORG_CHANNEL_MEMBER_REMOVE	operations	Records collaboration org channel member remove.	Active
collaboration.org_channel.archive	COLLABORATION_ORG_CHANNEL_ARCHIVE	operations	Records collaboration org channel archive.	Active
collaboration.key_custody.released	COLLABORATION_KEY_CUSTODY_RELEASED	security	Records collaboration key custody released.	Active
collaboration.room_keys.released	COLLABORATION_ROOM_KEYS_RELEASED	operations	Records collaboration room keys released.	Active
collaboration.turn_retention.purged	COLLABORATION_TURN_RETENTION_PURGED	governance	Records collaboration turn retention purged.	Active
collaboration.turn_artifact_retention.purged	COLLABORATION_TURN_ARTIFACT_RETENTION_PURGED	governance	Records collaboration turn artifact retention purged.	Active
extension.execution.started	EXTENSION_EXECUTION_STARTED	extension	Records extension execution started.	Active
extension.execution.succeeded	EXTENSION_EXECUTION_SUCCEEDED	extension	Records extension execution succeeded.	Active
extension.execution.failed	EXTENSION_EXECUTION_FAILED	extension	Records extension execution failed.	Active
MCP_TOOL_EXECUTED	MCP_TOOL_EXECUTED	extension	Records mcp tool executed.	Active
MCP_SERVER_AVAILABILITY_CHANGED	MCP_SERVER_AVAILABILITY_CHANGED	extension	Records mcp server availability changed.	Active
EXTENSION_DYNAMIC_TOOLS_AUTHORIZED	EXTENSION_DYNAMIC_TOOLS_AUTHORIZED	extension	Records extension dynamic tools authorized.	Active
EXTENSION_DYNAMIC_TOOLS_REVOKED	EXTENSION_DYNAMIC_TOOLS_REVOKED	extension	Records extension dynamic tools revoked.	Active
EXTENSION_DYNAMIC_TOOLS_SYNCED	EXTENSION_DYNAMIC_TOOLS_SYNCED	extension	Records extension dynamic tools synced.	Active
EXTENSION_DYNAMIC_TOOLS_WITHHELD	EXTENSION_DYNAMIC_TOOLS_WITHHELD	extension	Records extension dynamic tools withheld.	Active
EXTENSION_DYNAMIC_TOOLS_REJECTED	EXTENSION_DYNAMIC_TOOLS_REJECTED	extension	Records extension dynamic tools rejected.	Active
a2a.publication.created	A2A_PUBLICATION_CREATED	operations	Records a2a publication created.	Active
a2a.publication.updated	A2A_PUBLICATION_UPDATED	operations	Records a2a publication updated.	Active
a2a.publication.republished	A2A_PUBLICATION_REPUBLISHED	operations	Records a2a publication republished.	Active
a2a.publication.unpublished	A2A_PUBLICATION_UNPUBLISHED	operations	Records a2a publication unpublished.	Active
a2a.task.created	A2A_TASK_CREATED	operations	Records a2a task created.	Active
a2a.task.canceled	A2A_TASK_CANCELED	operations	Records a2a task canceled.	Active
a2a.push_config.created	A2A_PUSH_CONFIG_CREATED	operations	Records a2a push config created.	Active
a2a.push_config.deleted	A2A_PUSH_CONFIG_DELETED	operations	Records a2a push config deleted.	Active
a2a.push_delivery.dead_lettered	A2A_PUSH_DELIVERY_DEAD_LETTERED	operations	Records a2a push delivery dead lettered.	Active
extension.catalog.uploaded	EXTENSION_CATALOG_UPLOADED	extension	Records extension catalog uploaded.	Active
extension.catalog.retired	EXTENSION_CATALOG_RETIRED	extension	Records extension catalog retired.	Active
extension.environment.enabled	EXTENSION_ENVIRONMENT_ENABLED	extension	Records extension environment enabled.	Active
extension.environment.disabled	EXTENSION_ENVIRONMENT_DISABLED	extension	Records extension environment disabled.	Active
extension.upgrade.proposed	EXTENSION_UPGRADE_PROPOSED	extension	Records extension upgrade proposed.	Active
extension.upgrade.published	EXTENSION_UPGRADE_PUBLISHED	extension	Records extension upgrade published.	Active
extension_source.created	EXTENSION_SOURCE_CREATED	extension	Records extension source created.	Active
extension_source.updated	EXTENSION_SOURCE_UPDATED	extension	Records extension source updated.	Active
extension_source.deleted	EXTENSION_SOURCE_DELETED	extension	Records extension source deleted.	Active
extension_source.signature_policy_changed	EXTENSION_SOURCE_SIGNATURE_POLICY_CHANGED	authorization	Records extension source signature policy changed.	Active
extension_source.sync_triggered	EXTENSION_SOURCE_SYNC_TRIGGERED	extension	Records extension source sync triggered.	Active
extension_source.sync_failed	EXTENSION_SOURCE_SYNC_FAILED	extension	Records extension source sync failed.	Active
extension_source.unsigned_policy_used	EXTENSION_SOURCE_UNSIGNED_POLICY_USED	authorization	Records extension source unsigned policy used.	Active
environment.create	WORKSPACE_ENVIRONMENT_CREATED	operations	Records environment create.	Active
environment.update	WORKSPACE_ENVIRONMENT_UPDATED	operations	Records environment update.	Active
environment.delete	WORKSPACE_ENVIRONMENT_DELETED	operations	Records environment delete.	Active
SUBSCRIPTION_CREATE	AUDIT_SUBSCRIPTION_CREATE	governance	Records subscription create.	Active
audit.test	AUDIT_TEST	governance	Records audit test.	Active
audit.export	AUDIT_EXPORT	governance	Records audit export.	Active
audit.retention.updated	AUDIT_RETENTION_UPDATED	governance	Records audit retention updated.	Active
license.updated	LICENSE_UPDATED	governance	Records license updated.	Active
audit.chain.checkpoint	AUDIT_CHAIN_CHECKPOINT	governance	Records audit chain checkpoint.	Legacy read-only
audit.chain.verify	AUDIT_CHAIN_VERIFY	governance	Records audit chain verify.	Active
dlp.policy.activated	DLP_POLICY_ACTIVATED	authorization	Records dlp policy activated.	Active
dlp.policy.updated	DLP_POLICY_UPDATED	authorization	Records dlp policy updated.	Active
dlp.policy.reviewed	DLP_POLICY_REVIEWED	authorization	Records dlp policy reviewed.	Active
dlp.policy.review_overdue	DLP_POLICY_REVIEW_OVERDUE	authorization	Records dlp policy review overdue.	Active
dlp.policy.exception_skipped	DLP_POLICY_EXCEPTION_SKIPPED	authorization	Records dlp policy exception skipped.	Active
dlp.policy.rule_unsafe	DLP_POLICY_RULE_UNSAFE	authorization	Records dlp policy rule unsafe.	Active
dlp.scan.input	DLP_SCAN_INPUT	security	Records dlp scan input.	Active
dlp.scan.output	DLP_SCAN_OUTPUT	security	Records dlp scan output.	Active
dlp.violation	DLP_VIOLATION	security	Records dlp violation.	Active
dlp.action_taken	DLP_ACTION_TAKEN	security	Records dlp action taken.	Active
dlp.override.granted	DLP_OVERRIDE_GRANTED	authorization	Records dlp override granted.	Active
dlp.override.rejected	DLP_OVERRIDE_REJECTED	security	Records dlp override rejected.	Active
dlp.classifier.degraded	DLP_CLASSIFIER_DEGRADED	security	Records dlp classifier degraded.	Active
dlp.prompt_injection.detected	DLP_PROMPT_INJECTION_DETECTED	security	Records dlp prompt injection detected.	Active
dlp.hits.acknowledged	DLP_HITS_ACKNOWLEDGED	security	Records dlp hits acknowledged.	Active
dlp.exception.activated	DLP_EXCEPTION_ACTIVATED	security	Records dlp exception activated.	Active
dlp.exception.expired	DLP_EXCEPTION_EXPIRED	security	Records dlp exception expired.	Active
dlp.pre_action.blocked	DLP_PRE_ACTION_BLOCKED	security	Records dlp pre action blocked.	Active
company_context.ensured	COMPANY_CONTEXT_ENSURED	data	Records company context ensured.	Active
company_context.page.create	COMPANY_CONTEXT_PAGE_CREATE	data	Records company context page create.	Active
company_context.page.update	COMPANY_CONTEXT_PAGE_UPDATE	data	Records company context page update.	Active
company_context.page.delete	COMPANY_CONTEXT_PAGE_DELETE	data	Records company context page delete.	Active
company_context.page.reclassify	COMPANY_CONTEXT_PAGE_RECLASSIFY	data	Records company context page reclassify.	Active
company_context.source.ingest	COMPANY_CONTEXT_SOURCE_INGEST	data	Records company context source ingest.	Active
company_context.source.retry	COMPANY_CONTEXT_SOURCE_RETRY	data	Records company context source retry.	Active
company_context.source.bulk-delete	COMPANY_CONTEXT_SOURCE_BULK_DELETE	data	Records company context source bulk delete.	Active
company_context.folder.delete	COMPANY_CONTEXT_FOLDER_DELETE	data	Records company context folder delete.	Active
moderation.policy.updated	MODERATION_POLICY_UPDATED	authorization	Records moderation policy updated.	Active
moderation.policy.hit	MODERATION_POLICY_HIT	authorization	Records moderation policy hit.	Active
classification.scheme_updated	CLASSIFICATION_SCHEME_UPDATED	governance	Records classification scheme updated.	Active
classification.document_labelled	CLASSIFICATION_DOCUMENT_LABELLED	data	Records classification document labelled.	Active
classification.endpoint_rated	CLASSIFICATION_ENDPOINT_RATED	governance	Records classification endpoint rated.	Active
classification.aggregation_capped	CLASSIFICATION_AGGREGATION_CAPPED	governance	Records classification aggregation capped.	Active
security.clearance_granted	CLEARANCE_GRANTED	authorization	Records security clearance granted.	Active
security.clearance_override_created	CLEARANCE_OVERRIDE_CREATED	authorization	Records security clearance override created.	Active
security.clearance_baseline_set	CLEARANCE_BASELINE_SET	authorization	Records security clearance baseline set.	Active
security.clearance_revoked	CLEARANCE_REVOKED	authorization	Records security clearance revoked.	Active
security.sessions_terminated	SESSIONS_TERMINATED	authentication	Records security sessions terminated.	Active
security.spillage_detected	SPILLAGE_DETECTED	security	Records security spillage detected.	Active
security.clearance_egress_blocked	CLEARANCE_EGRESS_BLOCKED	authorization	Records security clearance egress blocked.	Active
impersonation.session.created	IMPERSONATION_SESSION_CREATED	authentication	Records impersonation session created.	Active
impersonation.session.ended	IMPERSONATION_SESSION_ENDED	authentication	Records impersonation session ended.	Active
oauth.authorization.refused	OAUTH_AUTHORIZATION_REFUSED	authorization	Records oauth authorization refused.	Active
scim.user.provisioned	SCIM_USER_PROVISIONED	security	Records scim user provisioned.	Active
scim.user.updated	SCIM_USER_UPDATED	security	Records scim user updated.	Active
scim.user.deactivated	SCIM_USER_DEACTIVATED	security	Records scim user deactivated.	Active
scim.user.reactivated	SCIM_USER_REACTIVATED	security	Records scim user reactivated.	Active
scim.user.linked	SCIM_USER_LINKED	security	Records scim user linked.	Active
scim.group.created	SCIM_GROUP_CREATED	security	Records scim group created.	Active
scim.group.updated	SCIM_GROUP_UPDATED	security	Records scim group updated.	Active
scim.group.deleted	SCIM_GROUP_DELETED	security	Records scim group deleted.	Active
scim.group.member_added	SCIM_GROUP_MEMBER_ADDED	security	Records scim group member added.	Active
scim.group.member_removed	SCIM_GROUP_MEMBER_REMOVED	security	Records scim group member removed.	Active
scim.token.generated	SCIM_TOKEN_GENERATED	security	Records scim token generated.	Active
scim.token.revoked	SCIM_TOKEN_REVOKED	security	Records scim token revoked.	Active
sso.provider.registered	SSO_PROVIDER_REGISTERED	security	Records sso provider registered.	Active
sso.provider.updated	SSO_PROVIDER_UPDATED	security	Records sso provider updated.	Active
sso.provider.deleted	SSO_PROVIDER_DELETED	security	Records sso provider deleted.	Active
sso.enforcement.changed	SSO_ENFORCEMENT_CHANGED	security	Records sso enforcement changed.	Active
sso.idp_initiated.changed	SSO_IDP_INITIATED_CHANGED	security	Records sso idp initiated changed.	Active
sso.domain_verification.requested	SSO_DOMAIN_VERIFICATION_REQUESTED	security	Records sso domain verification requested.	Active
sso.domain.verified	SSO_DOMAIN_VERIFIED	security	Records sso domain verified.	Active
sso.domain_verification.bypassed	SSO_DOMAIN_VERIFICATION_BYPASSED	security	Records sso domain verification bypassed.	Active
sso.domain_verification.required	SSO_DOMAIN_VERIFICATION_REQUIRED	security	Records sso domain verification required.	Active
sso.signing_key.changed	SSO_SIGNING_KEY_CHANGED	security	Records sso signing key changed.	Active
sso.assurance.changed	SSO_ASSURANCE_CHANGED	security	Records sso assurance changed.	Active
sso.metadata_anchors.changed	SSO_METADATA_ANCHORS_CHANGED	security	Records sso metadata anchors changed.	Active
sso.assurance.refused	SSO_ASSURANCE_REFUSED	security	Records sso assurance refused.	Active
sso.enforcement.refused	SSO_ENFORCEMENT_REFUSED	security	Records sso enforcement refused.	Active
sso.change.requested	SSO_CHANGE_REQUESTED	security	Records sso change requested.	Active
sso.change.approved	SSO_CHANGE_APPROVED	security	Records sso change approved.	Active
sso.change.rejected	SSO_CHANGE_REJECTED	security	Records sso change rejected.	Active
sso.dual_control.changed	SSO_DUAL_CONTROL_CHANGED	security	Records sso dual control changed.	Active
table.create	TABLE_CREATE	data	Records table create.	Active
table.update	TABLE_UPDATE	data	Records table update.	Active
table.delete	TABLE_DELETE	data	Records table delete.	Active
table.archive	TABLE_ARCHIVE	data	Records table archive.	Active
table.restore	TABLE_RESTORE	data	Records table restore.	Active
table.write	TABLE_WRITE	data	Records table write.	Active
table.external_commit_reconciled	TABLE_EXTERNAL_COMMIT_RECONCILED	data	Records table external commit reconciled.	Active
table.maintenance_snapshots_expired	TABLE_MAINTENANCE_SNAPSHOTS_EXPIRED	data	Records table maintenance snapshots expired.	Active
table.maintenance_completed	TABLE_MAINTENANCE_COMPLETED	data	Records table maintenance completed.	Active
table.orphan_reclaimed	TABLE_ORPHAN_RECLAIMED	data	Records table orphan reclaimed.	Active
table.warehouse_drift_detected	TABLE_WAREHOUSE_DRIFT_DETECTED	data	Records table warehouse drift detected.	Active
table.warehouse_profile_reconciled	TABLE_WAREHOUSE_PROFILE_RECONCILED	data	Records table warehouse profile reconciled.	Active
table.orphan_detected	TABLE_ORPHAN_DETECTED	data	Records table orphan detected.	Active
table.cutover_started	TABLE_CUTOVER_STARTED	data	Records table cutover started.	Active
table.cutover_completed	TABLE_CUTOVER_COMPLETED	data	Records table cutover completed.	Active
table.cutover_failed	TABLE_CUTOVER_FAILED	data	Records table cutover failed.	Active
policy.compile	POLICY_COMPILE	authorization	Records policy compile.	Active
data_source.applied	DATA_SOURCE_APPLIED	data	Records data source applied.	Active
data-source.resolve-conflict	DATA_SOURCE_RESOLVE_CONFLICT	data	Records data source resolve conflict.	Active
data-source.pause	DATA_SOURCE_PAUSE	data	Records data source pause.	Active
data-source.resume	DATA_SOURCE_RESUME	data	Records data source resume.	Active
data-source.sync-request	DATA_SOURCE_SYNC_REQUEST	data	Records data source sync request.	Active
data-source.remove	DATA_SOURCE_REMOVE	data	Records data source remove.	Active
data_source.table_classification.updated	DATA_SOURCE_TABLE_CLASSIFICATION_UPDATED	data	Records data source table classification updated.	Active
data_source.instance.created	DATA_SOURCE_INSTANCE_CREATED	data	Records data source instance created.	Active
data_source.instance.repinned	DATA_SOURCE_INSTANCE_REPINNED	data	Records data source instance repinned.	Active
data_source.instance.removed	DATA_SOURCE_INSTANCE_REMOVED	data	Records data source instance removed.	Active
data_source.query_tables.selected	DATA_SOURCE_QUERY_TABLES_SELECTED	data	Records data source query tables selected.	Active
data_source.schedule.set	DATA_SOURCE_SCHEDULE_SET	data	Records data source schedule set.	Active
data_source.query_columns.accepted	DATA_SOURCE_QUERY_COLUMNS_ACCEPTED	data	Records data source query columns accepted.	Active
data_source.alerts.set	DATA_SOURCE_ALERTS_SET	data	Records data source alerts set.	Active
data_source.connection_grant.issued	DATA_SOURCE_CONNECTION_GRANT_ISSUED	authorization	Records data source connection grant issued.	Active
data_source.connection_grant.refused	DATA_SOURCE_CONNECTION_GRANT_REFUSED	authorization	Records data source connection grant refused.	Active
data_source.connection_access.requested	DATA_SOURCE_CONNECTION_ACCESS_REQUESTED	data	Records data source connection access requested.	Active
data_source.classification.set	DATA_SOURCE_CLASSIFICATION_SET	data	Records data source classification set.	Active
query-catalog.registered	QUERY_CATALOG_REGISTERED	operations	Records query catalog registered.	Active
query-catalog.failed	QUERY_CATALOG_FAILED	operations	Records query catalog failed.	Active
query-catalog.cleanup	QUERY_CATALOG_CLEANUP	operations	Records query catalog cleanup.	Active
policy.create	POLICY_CREATE	authorization	Records policy create.	Active
policy.update	POLICY_UPDATE	authorization	Records policy update.	Active
policy.delete	POLICY_DELETE	authorization	Records policy delete.	Active
iceberg.config	ICEBERG_CONFIG	data	Records iceberg config.	Active
iceberg.catalog	ICEBERG_CATALOG	data	Records iceberg catalog.	Active
egress.blocked	EGRESS_BLOCKED	security	Records egress blocked.	Active
egress.allowed	EGRESS_ALLOWED	security	Records egress allowed.	Active
extension.connection.created	EXTENSION_CONNECTION_CREATED	extension	Records extension connection created.	Active
extension.connection.updated	EXTENSION_CONNECTION_UPDATED	extension	Records extension connection updated.	Active
extension.connection.deleted	EXTENSION_CONNECTION_DELETED	extension	Records extension connection deleted.	Active
extension.connection.access_granted	EXTENSION_CONNECTION_ACCESS_GRANTED	authorization	Records extension connection access granted.	Active
extension.connection.access_revoked	EXTENSION_CONNECTION_ACCESS_REVOKED	extension	Records extension connection access revoked.	Active
chat.admin.access	CHAT_ADMIN_ACCESS	operations	Records chat admin access.	Active
chat.message.truncated	CHAT_MESSAGE_TRUNCATED	operations	Records chat message truncated.	Active
chat.history.search	CHAT_HISTORY_SEARCH	operations	Records chat history search.	Active
chat.conversation.archived	CHAT_CONVERSATION_ARCHIVED	operations	Records chat conversation archived.	Active
chat.conversation.deleted	CHAT_CONVERSATION_DELETED	operations	Records chat conversation deleted.	Active
chat.conversation.created	CHAT_CONVERSATION_CREATED	operations	Records chat conversation created.	Active
chat.message.sent	CHAT_MESSAGE_SENT	operations	Records chat message sent.	Active
chat.message.received	CHAT_MESSAGE_RECEIVED	operations	Records chat message received.	Active
chat.message.aborted	CHAT_MESSAGE_ABORTED	operations	Records chat message aborted.	Active
cortex.plan.built	CORTEX_PLAN_BUILT	operations	Records cortex plan built.	Active
cortex.plan.failed	CORTEX_PLAN_FAILED	operations	Records cortex plan failed.	Active
cortex.plan.message	CORTEX_PLAN_MESSAGE	operations	Records cortex plan message.	Active
SIGNIN_FAILED	SIGNIN_FAILED	authentication	Records signin failed.	Active
SIGNIN_RATE_LIMITED	SIGNIN_RATE_LIMITED	authentication	Records signin rate limited.	Active
2FA_FAILED	TWO_FACTOR_FAILED	operations	Records 2fa failed.	Active
SESSION_CREATE	SESSION_CREATE	authentication	Records session create.	Active
SESSION_REVOKE	SESSION_REVOKE	authentication	Records session revoke.	Active
super_admin.role.granted	SUPER_ADMIN_ROLE_GRANTED	authorization	Records super admin role granted.	Active
super_admin.org_membership.granted	SUPER_ADMIN_ORG_MEMBERSHIP_GRANTED	authorization	Records super admin org membership granted.	Active
super_admin.org_membership.elevated	SUPER_ADMIN_ORG_MEMBERSHIP_ELEVATED	security	Records super admin org membership elevated.	Active
service_account.permissions.updated	SERVICE_ACCOUNT_PERMISSIONS_UPDATED	operations	Records service account permissions updated.	Active
service_account.secret.rotated	SERVICE_ACCOUNT_SECRET_ROTATED	extension	Records service account secret rotated.	Active
service_account.clearance.updated	SERVICE_ACCOUNT_CLEARANCE_UPDATED	authorization	Records service account clearance updated.	Active
service_account.token.issued	SERVICE_ACCOUNT_TOKEN_ISSUED	security	Records service account token issued.	Active
service_account.token.refused	SERVICE_ACCOUNT_TOKEN_REFUSED	security	Records service account token refused.	Active
service_account.router_key.created	SERVICE_ACCOUNT_ROUTER_KEY_CREATED	operations	Records service account router key created.	Active
service_account.router_key.rotated	SERVICE_ACCOUNT_ROUTER_KEY_ROTATED	operations	Records service account router key rotated.	Active
service_account.router_key.revoked	SERVICE_ACCOUNT_ROUTER_KEY_REVOKED	operations	Records service account router key revoked.	Active
service_account.credential.connected	SERVICE_ACCOUNT_CREDENTIAL_CONNECTED	operations	Records service account credential connected.	Active
service_account.credential.disconnected	SERVICE_ACCOUNT_CREDENTIAL_DISCONNECTED	operations	Records service account credential disconnected.	Active
extension.account.owner_reassigned	EXTENSION_ACCOUNT_OWNER_REASSIGNED	extension	Records extension account owner reassigned.	Active
extension.cli_tier.raised	EXTENSION_CLI_TIER_RAISED	authorization	Records extension cli tier raised.	Active
extension.cli_tier.lowered	EXTENSION_CLI_TIER_LOWERED	authorization	Records extension cli tier lowered.	Active
peer.registered	PEER_REGISTERED	security	Records peer registered.	Active
peer.revoked	PEER_REVOKED	security	Records peer revoked.	Active
trusted_issuer.registered	TRUSTED_ISSUER_REGISTERED	security	Records trusted issuer registered.	Active
federated_credential.attached	FEDERATED_CREDENTIAL_ATTACHED	security	Records federated credential attached.	Active
trusted_issuer.removed	TRUSTED_ISSUER_REMOVED	security	Records trusted issuer removed.	Active
federated_credential.revoked	FEDERATED_CREDENTIAL_REVOKED	security	Records federated credential revoked.	Active
api_key.revoked	API_KEY_REVOKED	security	Records api key revoked.	Active
workflow.hitl.reviewers_selected	HITL_REVIEWERS_SELECTED	authorization	Records workflow hitl reviewers selected.	Active
workflow.hitl.reviewer_selection_refused	HITL_REVIEWER_SELECTION_REFUSED	authorization	Records workflow hitl reviewer selection refused.	Active
process_flow.destruction.recorded	PROCESS_FLOW_DESTRUCTION_RECORDED	governance	Records process flow destruction recorded.	Active
document_grant.created	DOCUMENT_GRANT_CREATED	authorization	Records document grant created.	Active
document_grant.revoked	DOCUMENT_GRANT_REVOKED	authorization	Records document grant revoked.	Active
knowledge.document.restricted	KNOWLEDGE_DOCUMENT_RESTRICTED	authorization	Records knowledge document restricted.	Active
knowledge.document.unrestricted	KNOWLEDGE_DOCUMENT_UNRESTRICTED	authorization	Records knowledge document unrestricted.	Active

Audit resource types

Resource type	Registry key	Description
acsStep	ACS_STEP	Audit subject representing acs step.
secret	SECRET	Audit subject representing secret.
secretProvider	SECRET_PROVIDER	Audit subject representing secret provider.
ssoProvider	SSO_PROVIDER	Audit subject representing sso provider.
user	USER	Audit subject representing user.
organization	ORGANIZATION	Audit subject representing organization.
organizationMember	ORGANIZATION_MEMBER	Audit subject representing organization member.
workspace	WORKSPACE	Audit subject representing workspace.
workspaceEnvironment	WORKSPACE_ENVIRONMENT	Audit subject representing workspace environment.
file	FILE	Audit subject representing file.
workflow	WORKFLOW	Audit subject representing workflow.
knowledgeBase	KNOWLEDGE_BASE	Audit subject representing knowledge base.
kb_page	KB_PAGE	Audit subject representing kb page.
document	DOCUMENT	Audit subject representing document.
folder	FOLDER	Audit subject representing folder.
template	TEMPLATE	Audit subject representing template.
processFlow	PROCESS_FLOW	Audit subject representing process flow.
processTemplate	process_flow	Audit subject representing process template.
schedule	SCHEDULE	Audit subject representing schedule.
memory	MEMORY	Audit subject representing memory.
chat	CHAT	Audit subject representing chat.
webhook	WEBHOOK	Audit subject representing webhook.
copilotTool	COPILOT_TOOL	Audit subject representing copilot tool.
extension	EXTENSION	Audit subject representing extension.
extensionEntitlement	EXTENSION_ENTITLEMENT	Audit subject representing extension entitlement.
mcpServer	MCP_SERVER	Audit subject representing mcp server.
mcpRegistry	MCP_REGISTRY	Audit subject representing mcp registry.
a2aAgent	A2A_AGENT	Audit subject representing a2a agent.
a2aTask	A2A_TASK	Audit subject representing a2a task.
a2aPushConfig	A2A_PUSH_CONFIG	Audit subject representing a2a push config.
extension_source	EXTENSION_SOURCE	Audit subject representing extension source.
eventLogReceiver	AUDIT_LOG_SUBSCRIPTION	Audit subject representing event log receiver.
eventLog	AUDIT_LOG	Audit subject representing event log.
eventLogRetentionConfig	AUDIT_LOG_RETENTION_CONFIG	Audit subject representing event log retention config.
license	LICENSE	Audit subject representing license.
auditChain	AUDIT_CHAIN	Audit subject representing audit chain.
session	SESSION	Audit subject representing session.
userClearance	USER_CLEARANCE	Audit subject representing user clearance.
organizationPolicy	ORGANIZATION_POLICY	Audit subject representing organization policy.
extension_connection	EXTENSION_CONNECTION	Audit subject representing extension connection.
dlpHits	DLP_HITS	Audit subject representing dlp hits.
organizationExtensionAccount	ORGANIZATION_EXTENSION_ACCOUNT	Audit subject representing organization extension account.
dlpPolicy	DLP_POLICY	Audit subject representing dlp policy.
moderationPolicy	MODERATION_POLICY	Audit subject representing moderation policy.
User	SCIM_USER	Audit subject representing user.
Group	SCIM_GROUP	Audit subject representing group.
Token	SCIM_TOKEN	Audit subject representing token.
sandbox-egress	SANDBOX_EGRESS	Audit subject representing sandbox egress.
managed_table	MANAGED_TABLE	Audit subject representing managed table.
managed-table	MANAGED_TABLE_HYPHENATED	Audit subject representing managed table.
policy-bundle	POLICY_BUNDLE	Audit subject representing policy bundle.
data_source	DATA_SOURCE	Audit subject representing data source.
data-source	DATA_SOURCE_HYPHENATED	Audit subject representing data source.
data-access-policy	DATA_ACCESS_POLICY	Audit subject representing data access policy.
iceberg_catalog	ICEBERG_CATALOG	Audit subject representing iceberg catalog.
chat_conversation	CHAT_CONVERSATION	Audit subject representing chat conversation.
chat_message_embedding	CHAT_MESSAGE_EMBEDDING	Audit subject representing chat message embedding.
chat_message	CHAT_MESSAGE	Audit subject representing chat message.
workflow_plan	WORKFLOW_PLAN	Audit subject representing workflow plan.
extensionInstall	EXTENSION_INSTALL	Audit subject representing extension install.
policyExecutionGrant	POLICY_EXECUTION_GRANT	Audit subject representing policy execution grant.
authorizationContext	AUTHORIZATION_CONTEXT	Audit subject representing authorization context.
blockPreset	BLOCK_PRESET	Audit subject representing block preset.
objectType	OBJECT_TYPE	Audit subject representing object type.
linkType	LINK_TYPE	Audit subject representing link type.
actionType	ACTION_TYPE	Audit subject representing action type.
objectInstance	OBJECT_INSTANCE	Audit subject representing object instance.
linkInstance	LINK_INSTANCE	Audit subject representing link instance.
ontologyEffect	ONTOLOGY_EFFECT	Audit subject representing ontology effect.
ontologyBranch	ONTOLOGY_BRANCH	Audit subject representing ontology branch.
ontologyTaxonomy	ONTOLOGY_TAXONOMY	Audit subject representing ontology taxonomy.
cortexTurn	CORTEX_TURN	Audit subject representing cortex turn.
extensionCatalog	EXTENSION_CATALOG	Audit subject representing extension catalog.
serviceAccount	SERVICE_ACCOUNT	Audit subject representing service account.
serviceAccountCredential	SERVICE_ACCOUNT_CREDENTIAL	Audit subject representing service account credential.
trustedIssuer	TRUSTED_ISSUER	Audit subject representing trusted issuer.
serviceAccountFederatedCredential	SERVICE_ACCOUNT_FEDERATED_CREDENTIAL	Audit subject representing service account federated credential.
apikey	API_KEY	Audit subject representing apikey.
peerClient	PEER_CLIENT	Audit subject representing peer client.

Workflow lifecycle events

Action	Registry key
workflow.scheduled	SCHEDULED
workflow.started	STARTED
workflow.paused	PAUSED
workflow.resumed	RESUMED
workflow.completed	COMPLETED
workflow.failed	FAILED
workflow.terminated	TERMINATED
workflow.cancelled	CANCELLED
workflow.purged	PURGED

Workflow resources: workflowworkflow-executionworkflow-schedule

Integrity events

Action	Registry key
integrity.event-log.verification-failed	AUDIT_LOG_VERIFICATION_FAILED
integrity.event-log.checkpoint-failed	AUDIT_LOG_CHECKPOINT_FAILED
integrity.event-log.telemetry-dropped	AUDIT_LOG_TELEMETRY_DROPPED
integrity.dapr-history.verification-failed	DAPR_HISTORY_VERIFICATION_FAILED
integrity.dapr-history.configuration-mismatch	DAPR_SIGNING_CONFIGURATION_MISMATCH
integrity.incident.acknowledged	INCIDENT_ACKNOWLEDGED
integrity.incident.recovered	INCIDENT_RECOVERED

Integrity resources: event-log-chainevent-log-checkpointevent-log-telemetrydapr-workflow-historyintegrity-incident

Classified events

Audit list, filtered-list, and NDJSON export apply the same clearance rule. If an event is classified above the viewer's rank, or uses a different classification scheme, Scrydon returns the action, actor, organization, timestamp, decision evidence, and integrity-chain fields while replacing the resource ID and sensitive request context with null. The row includes redacted: true, and the Audit Log displays a lock. Select a row in the Audit Log to inspect its event, actor/resource, policy/classification, request, metadata, and chain-integrity evidence. The detail panel preserves the same clearance redaction as the list response.

Organizations without user-clearance records keep the previous visibility behavior. Historical rows are not reclassified.

Integrity

New events participate in a mandatory SHA-256 chain for their organization or global security scope. Signed ML-DSA-65 checkpoints can be verified from the Audit Log settings page or through the verification API. Recent valid rows can temporarily report “awaiting a checkpoint”; historical rows created before the cutover are explicitly reported outside the cryptographic proof. There is no configuration switch that disables chain integrity.

High-volume events — DLP scans, violations and enforcement actions, extension executions, moderation hits, and permitted authorization decisions — are stored in a separate telemetry store designed for their volume. They appear in the Audit Log in time order alongside every other event, marked as telemetry evidence: each is covered by a signed attestation window rather than the per-row chain, so chain verification does not include them. They are not yet included in NDJSON export or delivered to Log Receivers.

Authorization decision evidence is always complete by policy; there is no runtime logging tier. A degraded local enqueue raises an alert and can be reconciled only with the exact original decision ID and payload.