Glossary · Security & access
Audit log
Also called: activity log, audit trail, event log
An audit log is a chronological, tamper-resistant record of who did what in a system and when, kept so that changes, approvals and access can be traced afterwards.
When an automation does something surprising, the first question is "who changed it?". The second is "who approved that?". An audit log answers both.
What it should capture
- Changes: workflows edited, published or deleted; credentials and AI keys added or removed.
- Access: members invited, roles changed, sign-ins to sensitive areas, support access by outsiders.
- Decisions: approvals and rejections in a review step, with the reviewer's name.
- Money and data: billing changes, exports.
Each entry needs a timestamp, an actor (person or API key), the action and the object.
What it should leave out
Secrets and sensitive content. A log that records API keys or full prompts becomes the most valuable thing to steal. Log that a key changed, never the key.
Properties that make it trustworthy
Append-only (entries can't be edited or deleted, even by admins), exportable for auditors and incident reviews, and retained long enough for your obligations. Run history complements it: the audit log shows what people did; run traces show what workflows did.
In Fluxo Flow
Owners and admins see an activity log of edits, runs, approvals, invites, role and key changes, billing and exports. Entries can't be edited or deleted, can be exported as CSV, and never record secrets or prompts. Retention depends on the plan, from 30 days on Free to 3 years by default on Enterprise. Partner support visits to client workspaces are logged in the client's activity log.
Read next
Related terms
- RBAC (role-based access control)Role-based access control (RBAC) is a way of managing permissions in which access rights are attached to roles (such as Admin, Editor or Viewer) and people get rights by being assigned a role, rather than permission by permission.
- Scoped API keyA scoped API key is an API credential limited to specific permissions (scopes), often with an expiry date, so that a leaked or misused key can only do what it was explicitly allowed to do.
- Dead-letter queueA dead-letter queue is a holding place for messages or items that couldn't be processed after all retries, kept aside with their error so a person can inspect, fix and replay them instead of losing them.
- BYOK (bring your own key)BYOK, or bring your own key, means a software product runs its AI features on an API key from your own AI provider account, so usage is billed to you directly by the provider instead of being resold through the product.
- Approval workflowAn approval workflow is a process that routes a request (an invoice, an expense, a discount, a piece of content) to one or more designated people who must approve or reject it before it can proceed.