Audit log

Every actor action and protected-resource access. Filtered by date range, actor, action, or entity. Exports as CSV for compliance reviews.