Activity history
Definition
The workspace Audit Log records supported application events with their actor and action context. An artifact's history records its own changes and decisions. Trialground records candidate behavior captured by supported instrumentation. Use the surface that owns the question you are investigating.
Fields, states, or lifecycle rules
| Question | Surface | Scope |
|---|---|---|
| Who performed a recorded workspace action? | Admin → Insights → Audit Log | Events available to the authorized workspace reader |
| Who approved or changed a Policy or other governed artifact? | The artifact's activity or approval history | The particular object and version |
| What did this candidate do? | Benchmark Evaluations → Results and recorded steps | Captured requests, responses, tool activity, and capture status |
| Which credential resolution was allowed or denied? | Runtime credential-access records | The credential service's execution context; separate from universal audit coverage |
Inspect workspace events
Open Admin → Insights → Audit Log. Workspace audit access requires the activitylogs:read_all capability, granted separately from sign-in access and expert assignments.
Choose the date range and use the available actor, action, and IP filters. Inspect the action description and its Project or object context. When investigating missing results, check the selected range, filters, access, and the event types recorded by the operation.
Export a filtered CSV
Use Download first 1K records to download the first 1,000 matching records with the selected filters. The export includes timestamp in UTC, user, action type, description, Project ID, and IP where recorded. It is separate from the currently displayed page size.
For a review requiring more than the exported population, narrow the date range and retain the filter and range context with each file. Confirm coverage of the review period rather than treating a 1,000-row file as a complete workspace history. Handle the download as workspace information under your organization's access and retention requirements.
Interpret the records
Application events, infrastructure logs, approval history, and execution trajectories have distinct collection and retention scopes. The operational Log Analytics retention described in the Trust Center is not an Audit Log retention promise.
Captured execution records show the supported instrumentation and reported capture state. Interpret recorded actions alongside that capture state, and use the artifact's approval history to identify approved Policy versions and reviewer decisions.
The CSV export contains the matching application events described above. Review required event coverage, retention, delivery, storage, and integration needs as part of your security review, including any requirements for continuous delivery, immutable storage, or data-read records.