Audit Logs & Activity History

Audit Logs & Activity History

1. What it is

Audit Logs give admins a tamper-evident trail of changes across the platform — who did what, when, and from where. The trail is split into four surfaces, each focused on a different kind of activity: system-wide data changes, API calls, shift-assignment compliance decisions, and employment-law events.

• Enablement: The System and Employment Law surfaces are available to any admin. The API and Compliance surfaces require the Enterprise platform tier. API Audit Logs additionally require the “API → Manage” permission.
• What it is not: Audit Logs record platform activity — they are not the labor-law rule engine itself (that lives in Labor & Employment Law Rules) or the content moderation queue (that lives in Content Governance).

2. Standing it up

Audit logging is automatic — there is no setup step to “turn it on.” Records begin accumulating as soon as the platform is in use.

1. Go to Admin → System Audit Logs (the Settings Hub card labelled “System Audit Logs”).
2. The family navigation bar at the top links the four surfaces: System, API, Compliance, and Employment Law. Each tab is shown only when the current admin has the required tier and permission.
3. For the API tab to appear, the business must be on the Enterprise tier, and the admin’s role must include the “API → Manage” permission.
4. For the Compliance tab to appear, the business must be on the Enterprise tier.
5. To confirm it is working, the System tab should already show recent change entries.

No additional configuration is needed — there are no settings to enable or disable logging, and no per-surface opt-in. The Source dropdown in the System tab only lists sources that actually have data for this tenant, so an admin never sees an empty filter option.

3. How it fits together

System Audit Logs are the broadest surface. They combine records from multiple sources into a single unified feed:

• System Changes — PaperTrail version records tracking creates, updates, and deletes of core models (users, shifts, schedules, locations, departments, roles, and more). Every row shows who made the change, what fields moved from which value to which, and when.
• EPMS — performance review lifecycle events (created, submitted, approved, archived), visible only when the Employee Performance Management app is entitled.
• HR File Manager — file access events (viewed, downloaded, uploaded), visible only when the HR File Manager app is entitled.
• Email System — email delivery audit events tied to EPMS notifications.

The “Changed by” column shows one of three labels: the admin’s name when the actor is a member of this business, “User #" when the actor exists but is not a member here (a platform-level edit), or "System" when the change was made by automation with no human actor. The "Changed by" filter dropdown is scoped to this business's members only — a platform-level actor appears in the log itself but not in the filter picker, so an admin cannot browse foreign-tenant profiles through the filter.

Privacy redaction. Chat message bodies are withheld from the audit trail. The version row still preserves the old content — but it is not displayed, because chat’s own permission model has no path for an admin to read a room they are not a member of. The audit entry still shows that a message was edited, deleted, or restored.

Bulk operation grouping collapses related changes (CSV imports, auto-assignments, batch updates) into a single expandable row when the Grouped view is active. An admin can toggle between Grouped and Flat views at any time. The grouping covers ten operation types: CSV import, bulk create/update/delete, auto-assignment, auto-enrollment, scheduled job, API batch, system sync, and data migration.

API Audit Logs record every write operation and sensitive read made through the REST API. Each entry captures the controller, action, HTTP method, request path, response status, the API token used, the acting user, and the client IP address. Entries are classified by call type: customer API, mobile app, internal service, invalid token, or unauthenticated — so an admin can distinguish legitimate integrations from probing attempts. Customer API calls are always logged regardless of HTTP method. Internal service calls are logged only for write operations (POST, PUT, PATCH, DELETE). Invalid-token and unauthenticated attempts are always logged for security monitoring.

Compliance Audit Logs record shift-assignment compliance decisions made by the scheduling engine. Each entry is one of four event types — match calculation, compliance override, assignment blocked, or assignment allowed — and carries the decision outcome (allowed, blocked, or overridden), match and skill-match percentages, any compliance or labor-law violations detected, and the MangoScore multiplier applied. When an assignment is overridden, the log records who authorized the override, the stated reason, and whether it was flagged as an emergency override. The analytics dashboard adds two forward-looking panels beyond the audit trail itself: a weekly-hours risk view showing employees approaching the max-weekly-hours cap, and a work-context coverage view showing how much of the workforce is classified as frontline, desk, or hybrid (unclassified workers are invisible to frontline-scoped labor rules).

Employment Law Audit Logs are the immutable compliance trail. Once written, a record cannot be updated or deleted — the model raises an error on any attempt. These logs capture events from nine source systems (handbook grader, JD optimizer, compliance grader, scheduling engine, time tracking, leave management, onboarding, policy hub, and manual entry) and mark each event as compliant or non-compliant against the applicable employment-law rule and jurisdiction. Seventeen event types are tracked, including overtime calculations, break enforcement and violations, leave approvals and denials, scheduling validations, handbook checks, pay transparency validations, training requirements, accommodation requests, and fair-chance hiring events.

Where boundaries sit: Each of the four surfaces stores its records in a separate table with its own filters, CSV export, and analytics dashboard. The family navigation bar at the top of every surface lets an admin move between them without returning to the Settings Hub. The System tab’s detail drill-down (full changeset view) is available only for System Changes entries — other sources show summary details inline on the index page.

4. Running it

Reviewing system changes

1. Go to Admin → System Audit Logs.
2. Use the filter bar to narrow by item type, changed-by user, action (Created / Updated / Deleted), date range, or source (System Changes, EPMS, HR File Manager, Email System, Bulk Operation).
3. When no date range is specified, the view defaults to the last 7 days.
4. Click a System Changes entry to see the full changeset — which fields changed, from what value to what value, and who made the change. Other sources show summary details inline.
5. Toggle Grouped / Flat to collapse or expand bulk operations. In Grouped mode, a CSV import that created 50 users appears as one row; in Flat mode, all 50 individual entries show.

Reviewing API activity

1. Go to the API tab (Enterprise tier + “API → Manage” permission required).
2. The dashboard cards show total calls, calls today, success rate, and error rate.
3. Filter by date range, controller, action, HTTP method, response status (successful / client errors / server errors), API token, or user.
4. Click an entry to see the full request details including parameters, user agent, and referrer.

Exporting audit data

1. On any of the four surfaces, click Export CSV. The export applies the current filters but is not limited by the on-screen pagination — it exports the full filtered result set.
2. The CSV downloads immediately as unified_audit_logs_YYYYMMDD.csv (System), api_audit_logs_YYYYMMDD.csv (API), compliance_audit_logs_YYYY-MM-DD.csv (Compliance), or employment_law_audit_YYYY-MM-DD.csv (Employment Law).
3. Sample audit rows (loaded in development/demo environments) are excluded from the System export.

Reviewing compliance overrides

1. Go to the Compliance tab (Enterprise tier required).
2. The summary cards show total calculations, total overrides, emergency overrides, and the override rate for the last 30 days.
3. Use the Emergency only filter to isolate emergency overrides, or the Has violations filter to show only entries where compliance or labor-law violations were detected.
4. Filter by event type, decision, user, or date range to narrow the list.
5. Click Analytics to open a dedicated dashboard with:
   • Violation trends — daily violation counts and the top-10 most common violations.
   • Performance impact analysis — how MangoScore multipliers distribute across performance tiers.
   • Override patterns — overrides grouped by authorizer and by target user, plus emergency vs. regular split.
   • Weekly hours risk — employees approaching the max-weekly-hours cap this week (requires a rest-period setting with a weekly cap configured).
   • Work context coverage — how much of the workforce is classified frontline, desk, hybrid, or unclassified (unclassified workers are invisible to frontline-scoped labor rules).

Reviewing employment-law compliance

1. Go to the Employment Law tab.
2. The summary shows total events, compliant vs. non-compliant counts, and the compliance rate for the last 30 days.
3. Filter by event type (overtime calculated, break violation, leave approved, pay transparency validated, etc.), source system, jurisdiction, rule, or compliant/non-compliant status.
4. Click Analytics to see daily trends, event breakdown by source and document type, and recent violations.
5. Click any entry to see its full detail including the linked employment-law rule, jurisdiction, event data, and compliance status.

Loading sample data (development / demo environments only)

In a development or demo/QA tenant, the System tab shows Load sample data and Show/Hide sample buttons. Sample rows are badged “Sample”, excluded from CSV exports, and never created in production tenants. This lets an admin preview what a populated audit trail looks like before real activity accumulates.

5. Settings

Audit Logs have no admin-configurable settings — logging is always on and cannot be disabled. The key operational defaults are:

Behaviour	Default	What it means
System log default date range	7 days	The System tab loads the last 7 days when no date range is specified
Compliance emergency override	Off	New compliance audit entries are not flagged as an Emergency Override
Employment-law compliant flag	On	New employment-law entries are recorded as compliant; the source system marks them non-compliant for violations
Employment-law immutability	Always on	Records cannot be updated or deleted after creation — the system blocks both operations
Chat body redaction	Always on	Chat message content is withheld from the audit trail to respect chat’s permission model

6. More help

• Compliance Administration — overall compliance settings and policies
• Labor & Employment Law Rules — the rule engine whose events appear in the Employment Law tab
• Ask AI — the assistant answers questions about Audit Logs from this article.