Audit

Edition: Community and Enterprise

For internal audit, compliance and information security. The auditor role is read-only: you see every request's steps with values masked, and the audit log, and you change nothing.

Read the audit log

Select "Audit log" in the top bar. The page lists the latest events, newest first: number, time (UTC), actor, event, request and details. Select a request to see only its events.

The details hold ids, counts, codes, digests and names. They never hold a value, masked or not.

Verify the chain

The top of the audit log recomputes the chain on every load and says "Hash chain intact" with the number of events, or names the first event where it breaks.

For a stronger check, from the command line where the chain can be read:

sealfix audit verify --key <verifier key> --witness <checkpoint file>

It checks every signed checkpoint and reports anything removed from the end of the chain. See The audit trail.

Export the events

On "Audit log", select "Export as JSON lines". The file holds the whole chain, one event per line, each with its hash. Keep the last hash somewhere sealfix cannot write: anyone can later recompute the chain from the export and compare.

Questions an audit usually asks

Question	Where to find the answer
Who changed this customer record, and who approved it?	The request's trail on "Audit log"
Did anyone approve their own change?	Never possible; the rule is enforced in code and covered by tests
Was anything changed outside sealfix?	Not visible to sealfix: compare with the database's own audit
Can the log be edited?	No: append-only, hash-chained, with signed checkpoints
Which emergency changes are still unreviewed?	"Requests", narrowed with "Review owed" or "Review overdue"; "Emergencies" lists them all

The links that narrow "Requests" to emergencies appear only where some environment allows them. On "Audit log", every step of an emergency and of its review is an event, from emergency_declared to emergency_review_acknowledged. They hold names, roles, times and counts; the declared reason and a rejection's comment stay on the request. Every event of an emergency carries the badge "Emergency" beside the request's number.