Audit logs
Audit logs are Rival’s system of record: a time-stamped history of every activity executed across your organization. Governance policies and guardrails establish what is allowed to happen; audit logs are the evidence of what actually happened, when, and by whom.
What is tracked
Section titled “What is tracked”Audit logs capture system events across five operational dimensions.
- User and identity actions — authentication events, SSO logins, role changes, user invitations, and administrative setting updates.
- Execution telemetry — agent queries, multi-step workflow executions, function calls, and model response metadata.
- Approval checkpoints — every human sign-off, rejection, timeout, and escalation, including the reviewer’s identity and the timestamp.
- Connector and system access — data queries, read actions, and write operations across connected third-party systems.
- Asset lifecycle events — creation, modification, publishing, versioning, and deprecation of functions, agents, and workflows in the internal Marketplace.
Compliance and regulatory reporting
Section titled “Compliance and regulatory reporting”For organizations in regulated industries, demonstrating compliance is mandatory. Audit logs turn AI activity into structured audit trails.
- Regulatory transparency — prove to internal risk, legal, and compliance officers that data policies were enforced and guardrails stayed active.
- Verifiable approvals — show that high-consequence operations such as financial transactions or PII processing received mandatory human sign-off.
- Access verification — demonstrate that system access stayed confined to authorized roles and pre-approved connectors.
Detailed audit logging is frequently the prerequisite that lets risk and security teams approve broad AI deployment in the first place.
Incident response and root-cause investigation
Section titled “Incident response and root-cause investigation”When an unexpected output, data error, or unintended action occurs, the log turns an investigation into a traceback.
-
Locate the event — query the log history by timestamp, user, agent name, or outcome.
-
Trace the sequence — follow the execution path back through the workflow pipeline, identifying input parameters and intermediate reasoning steps.
-
Identify the sign-off — check whether a human approval was granted, who granted it, and which policy rules applied at execution time.
-
Remediate the policy — adjust the workflow steps, approval thresholds, or model guardrails so it cannot recur.
Visibility and access
Section titled “Visibility and access”Access to audit logs is governed strictly by platform role.
- Enterprise Admins — complete organization-wide visibility into all logs, security telemetry, activity trails, and compliance reports.
- Enterprise Team Members — scoped visibility, restricted to their own and their team’s execution activity.
- Standard users — visibility limited to their own account actions.
See the Capability matrix for the full breakdown by role.
Where the logs surface
Section titled “Where the logs surface”The audit log is the source the administrative dashboards read from.
- Requests shows the approval decisions the log records — pending, granted, and rejected.
- Adoption & AI-usage analytics aggregates execution telemetry into adoption, volume, and cost views.
Audit telemetry overview
Section titled “Audit telemetry overview”| Log category | Recorded data points | Operational value |
|---|---|---|
| Identity and access | SSO logins, role adjustments, user invites | Monitors directory security and user lifecycle changes |
| Execution runs | Workflow IDs, agent steps, model inputs and outputs | Guarantees end-to-end operational traceability |
| Human approvals | Approver identity, timestamp, decision | Serves as compliance proof for risk and legal teams |
| Connector usage | Read and write API queries, target platforms | Tracks external data access and system interactions |
| Governance events | Guardrail triggers, PII masking, policy blocks | Validates that platform security is being enforced |
A worked example: investigating an unintended dispatch
Section titled “A worked example: investigating an unintended dispatch”Consider a customer who receives an incorrect account notification.
- Incident inquiry — the customer reports an unexpected email notification.
- Log traceback — an Enterprise Admin opens the audit log, filters by the customer’s email address, and locates the specific workflow run.
- Root-cause analysis — the admin traces the execution history and finds the agent drafted the notification correctly, but a department lead mistakenly granted approval during manual review.
- Targeted resolution — the admin updates the approval rule to require a secondary sign-off for that notification type, with a complete time-stamped record of both the incident and the fix.