Audit Log

Every state change in ORKSTRA writes to an immutable audit log. The log is queryable, filterable, exportable, and — for Premium tenants — hash-chained to an append-only archive for forensic integrity.

Overview

The audit log is exposed in two places:

• Admin → Audit log — the global, multi-entity view for admins.
• Entity-level audit tab — every record (project, IPC, BOQ, etc.) has an Audit tab showing only that record's history.

Screenshot: Audit log table with filters for user, entity, action, time range

Key concepts

Audit event. A single write — (tenant, user, entity_type, entity_id, action, timestamp, payload_diff, ip, user_agent).

Action types. CREATE, UPDATE, DELETE, SOFT_DELETE, RESTORE, STATE_TRANSITION, LOGIN, LOGOUT, IMPERSONATE, DOWNLOAD, EXPORT, DECRYPT, …

Payload diff. For updates, the before/after of changed fields. Sensitive fields are masked.

Retention. Default 7 years. Configurable per tenant. Some categories (legal hold) have indefinite retention.

Immutable archive (Premium). Hash-chained append-only store. Even tenant admins cannot tamper with it.

Decrypt audit (Premium). Every decryption of a Fernet-encrypted field logs the requestor, field, reason.

Step-by-step: investigate a change

1. Admin → Audit log.
2. Filter by user, entity type, time range.
3. Click any row to expand the payload diff.
4. Export to CSV for forensic review.

Step-by-step: investigate a record's history

1. Open the record (e.g., a specific IPC).
2. Click the Audit tab.
3. See the full timeline with timestamps, users, and field changes.

Step-by-step: configure retention

1. Admin → Audit → Retention.
2. Pick the default retention period (years).
3. Add category-specific overrides for legal hold, etc.
4. Save. Existing events are not deleted until they age past the new threshold.

Common tasks

• Find who deleted X: filter for DELETE or SOFT_DELETE on the entity type.
• Find unusual activity: Anomaly review (Premium) flags statistical outliers.
• Export for auditors: CSV / PDF with full payload diffs.
• Restore a deleted record: if soft-deleted within retention, Admin → Audit → Restore.

Troubleshooting

• "I don't see a change that definitely happened." — Check the filter — most often the user or entity-type filter excludes the row.
• "Payload diff is empty for an update." — Updates that only touched timestamps or system fields show empty diff by design.
• "Restore failed." — Record may have been hard-deleted past retention. Once hard-deleted, restoration requires database-level intervention.

Permissions reference

Permission	Who needs it
AUDIT_LOG_VIEW	Admins, Auditors, Compliance
AUDIT_LOG_EXPORT	Admins, Auditors
AUDIT_RETENTION_CONFIGURE	Tenant admin
AUDIT_RESTORE	Admins

See also: RBAC, RBAC Premium + AI, Admin → Security.