> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.shieldtp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use the Audit Log

> Review attributable Forge and connected-system write outcomes without exposing raw sensitive payloads.

The organization Audit Log records terminal write outcomes from supported Forge activity, including user actions, agent tool actions, external system writes, and selected application changes.

Use it to answer:

* who or which agent initiated the action;
* which system and tool were involved;
* which ticket or other target was affected;
* whether the action succeeded or failed;
* when the terminal outcome occurred.

## Investigate an action

<Steps>
  <Step title="Set the time window">
    Start narrowly around the reported change.
  </Step>

  <Step title="Filter the actor or system">
    Distinguish a user action from a background agent or platform workflow.
  </Step>

  <Step title="Search the target">
    Use the exact ticket or supported target identifier when available.
  </Step>

  <Step title="Read the outcome">
    Identify the tool, status, and sanitized metadata.
  </Step>

  <Step title="Verify externally">
    Check the authoritative PSA or connected system for the resulting state.
  </Step>

  <Step title="Follow the workflow">
    Open the related Chat, ticket, project, agent run, or AI Engineer run for reasoning and context.
  </Step>
</Steps>

## What the log does not contain

The Audit Log is designed to record attributable outcomes without copying raw sensitive tool arguments, provider responses, error bodies, or executed code into the log. It is not a full replacement for the source provider's own audit history.

<Note>
  Read-only searches are not the primary purpose of this log. Use the relevant workflow history and provider records when investigating how a conclusion was formed.
</Note>

## Review rhythm

Administrators should sample successful writes as well as failures, investigate repeated errors, compare background behavior to configured Availability, and use findings to improve roles, mappings, runbooks, skills, and agents.