Audit log

The audit log is the append-only record of critical actions in your tenant: who changed what, when, and through which surface. It lives under Settings → Audits and is admin-only.

What is recorded

Every entry carries the actor (the user’s email, or system for platform-initiated actions), a timestamp, the action, the object it touched, and a one-line description.

Actions:

Action	Meaning
created / updated / deleted	Lifecycle changes to an object.
executed	Manual one-shot operations — garbage collection, a demand-set resync, resending an invitation.

Objects covered: demands, dashboards, alert rules, ingestion (custom) rules, notification channels, synthetic checks, agents, users and invitations, AI access tokens, the LeanBuddy tenant notebook, tenant settings, garbage collection, and demand-set syncs.

The “Via” column — Console, MCP, CLI

Each entry records the surface the change came from:

• Console — the LeanSignal app in a browser.
• MCP — an AI client writing through a write-scoped AI access token.
• CLI — the LeanSignal command-line client.

This matters most for AI-driven writes: a write-scoped MCP token acts as its owner, and the audit log is where those actions stay attributable and reviewable. If you grant an AI client write access, this page is how you watch what it does with it.

Reading the log

The table sorts by time (newest first) and filters by action, surface, and object type — “everything that deleted something”, “everything MCP did”, “every change to alert rules”. Entries are append-only: nothing on this page can be edited or removed.