Who was invited, whose role changed, who exported, who recovered.
Administration of the workspace is written to one tenant-scoped log: memberships and role changes, ownership transfers, project and organization creation, privacy requests, subscription changes, and every operator recovery action. Admins can browse it and export it within hard limits, and the export itself becomes an entry.
90 days
longest export window
10,000
record cap per export
5
kinds of actor the log can name
Without a shared foundation, every team rebuilds these edge cases, differently.
When each feature invents its own log shape, the question of who removed someone from a project has no single answer. One envelope with a declared actor type, resource type and outcome makes the trail readable.
A retried job writes a duplicate on every replay, and a trail that repeats itself stops being worth reading. A stable event ID with a conflict-do-nothing insert keeps replays quiet.
An unlimited download eventually asks for years of rows in one request, and you find out at the worst moment. Hard caps mean an oversized request is refused with a clear reason.
The mechanism end to end, as implemented in the repository.
One function writes every event
Server code records events using types from a central registry. Anything not yet integrated throws instead of quietly writing an unusable row.
Each event gets a stamped envelope
Schema version, actor, resource, outcome and a hashed IP are added and validated before saving. A raw IP address is never stored.
Admins browse their own history
Listing checks the admin role and the plan entitlement on the server, then pages backwards with a cursor, a hundred rows at a time, scoped to one organization.
Exports run inside hard limits
Up to 90 days and 10,000 records, and an oversized request is refused with a typed error rather than attempted.
Interactive example
This walkthrough demonstrates the implemented backend contract without using an account, credentials, or provider calls.
Interactive example
Deterministic sample data only. No account, provider, or network connection is used by the interaction.
Highlights
Every event goes through one function with a registry-validated envelope, and a retried job writing the same event ID becomes a no-op rather than a second line.
Only organization admins whose plan grants audit access can browse or export, verified on every call. A hidden tab is never the thing protecting the log.
An export covers at most 90 days and 10,000 records, in JSON or NDJSON, and the fact that it happened is itself recorded.
Engineering guarantees
This log covers workspace administration, not the content of growth records. What an account or a decision said at a past moment is the Time Machine’s job, and it reconstructs the record rather than naming who changed it. Retention is declared per event type; running the purge that enforces it is a deployment step.
The boundary above is code, not a claim. These files carry the contract:
src/features/enterprise/server.tssrc/registries/audit-events.tssrc/features/enterprise/contracts.tsThese capabilities share contracts and boundaries with this one.
The docs describe the same contracts this page demonstrates.