Pengaturan

The audit log

One chronological trail of the high-trust actions in your organisation — people, API keys and agents in the same stream, with actor, target and outcome.

Terakhir diperbarui

Who this is for: Owner, Manager — requires org.audit.read. Where: Settings → Audit Log

Role changes, membership grants, API keys at work, agent tool calls: the actions that matter after the fact are recorded here, newest first.

The defining property of this log is that there is one of it. A change made by a person in the UI, by an integration holding an API key, and by an MCP agent acting on somebody's behalf all land in the same stream, in the same shape. There is no separate "machine log" to reconcile against the human one.

Read a row#

Column What it tells you
When The time of the action, in your property's timezone
Actor Who did it — a person, an API key, or an agent
Channel How it arrived: the app, the API, or an agent tool call
Action What was done, e.g. member.revoked
Target What it was done to — the object type and a short id
Outcome ok, or the way it failed

Channel is the column people underuse. It is what separates "the Manager changed this" from "something holding the Manager's API key changed this", and those are different conversations.

Find what you are looking for#

The log is a single chronological stream: there is no actor, date or action filter on the screen today. To find a specific event:

  1. Open Settings → Audit Log.
  2. Narrow by time — the newest entries are at the top, so recent work is usually on screen already.
  3. Use your browser's find-in-page for an actor's name or an action like role.created.

Catatan

The list shows the organisation's recent trail rather than its entire history. If you need a long-range or filtered extract — for an auditor, or an incident review — that is a request to the Nerve team rather than something to reconstruct by scrolling.

Failures are recorded too#

An outcome that is not ok is not noise, and it is the reason to read the log rather than to trust that the trail only contains things that worked. A refused action still tells you somebody tried: a revoked API key still being used, a member reaching for a screen they no longer hold, a permission that was removed a week ago and is still being exercised by an integration nobody updated.

Agent activity is in here, not somewhere else#

An MCP agent's tool calls appear as ordinary rows with their own actor and the agent channel. Nerve's position is that an agent acting for you is auditable in exactly the way you are — tools are permission-filtered to the connected context, sensitive actions are confirmed, and every call is written here. See MCP agents.

What's next#