Audit & compliance

In one line. What gets recorded where — the usage log, the immutable audit trail — and how you version, freeze, and publish a solution’s configuration so an auditor can trust it. You’ll be able to. Read and export the audit trail, pull one document’s complete timeline, tell Activity from Audit, snapshot and freeze a project’s configuration, and publish it as a Solution. Where this lives. Studio ▸ Security (Activity · Audit), the Audit trail sheet on any document, and Studio ▸ Project ▸ Version Control / Studio ▸ Project ▸ Publish.

Two logs, two questions

The platform keeps two separate records, and mixing them up wastes time:

• Activity = usage analytics. “How much time did reviewers spend, on what, and how many annotations did they make?”
• Audit = the compliance trail. “Who touched what, when?” — the legal record.

Reach for Audit when someone asks a compliance question. (Run traces — what an agent or pipeline actually did — are a third record, covered in G4 · Observability.)

Activity

Studio ▸ Security ▸ Activity — an operational usage log of document sessions. This is usage analytics, not the compliance audit.

The layout is a Group-By tab strip on top, a filter bar, then a virtual-scrolled table with Load more and Export.

Control	What it does
Group By (4 modes)	Re-shapes the table: Session Logs (raw, ungrouped), Documents, Users, Document Stages. Each mode swaps the columns — e.g. Documents shows Title / User Count / Sessions Count / Annotations Count / Active Time / Session Time, with time shown as total (Avg x).
Filters	Document-name search, User emails multi-select, Workflow stages multi-select, and a time range date-time picker. A clear-filter resets all.
Export	Downloads the activity logs.
Row download	Per-row download of that entry’s logs (opens a result URL).
Load more	Pages through more rows.

Under the hood. The word “Document” in the headings is rewritten to your project’s entity name (so for an Invoices project you’ll see “Invoice”). Times are humanized and localized to your subscription’s date format.

Audit

Studio ▸ Security ▸ Audit — the security / compliance audit trail. Every access, create, update, delete, and download is recorded here — and so are export runs and notification sends (with per-recipient delivery status), so the trail has no silent endings: a document’s story runs from arrival all the way to the export or email that left the building. This is the immutable record of who did what to which document, and the record you hand an auditor.

The layout is a filter bar over a shared audit table with four columns: UserEmail, LogTime, AreaType, Description.

Control	What it does
Document-name search	Free-text filter on document name.
User emails	Restrict to specific users.
Learner → Label	Pick a Learner; the Label list cascades from it.
Category / Sub-category	Filter by collection category (admin/system templates excluded).
Operation	The event type: Access, Create, Update, Delete, Download.
Time range	A date-time window.
Export	Export the filtered audit rows (through the audit table).

Behaviours to know

• Deep-link filters. The audit page accepts a ?filterquery= JSON parameter, so other screens can jump into the audit pre-filtered (for example, from a document straight to “everything that happened to this document”). When you arrive via such a link, the filters are already set.
• Actor identity is stored, not guessed. Every row records what kind of actor acted — human, agent, system, or api-key — stamped when the row is written. “A person did this” vs “automation did this” is a stored fact.
• Rows are immutable, retention is policy. Once written, an audit row cannot be rewritten through the write path (re-sending the same event is a no-op). Rows are kept forever unless an admin deliberately configures a retention window (AuditLogRetentionDays).
• It’s a compliance record. The audit log is a read-only history — you filter and export it, you don’t edit it. Treat it as the authoritative answer to “prove who approved this.”

The per-document Audit trail

“What exactly happened to this document?” used to be a database question; now it’s a click. The Audit trail side-sheet — opened from a document row’s ⋮ menu or the clock button in the document header — federates the seven underlying stores (workflow history, label edits, agent runs, xflow steps, mesh runs, ingestion phases, and the audit log — exports and notifications included) into one newest-first timeline. Events group by phase — Ingestion · Processing · Review · Output · Error — each with an actor chip (human / agent / system / api-key), a plain-language summary, and expandable before/after detail; a { } Sources lens shows which stores answered, and a sick source is flagged as unavailable rather than silently missing. Export CSV downloads the loaded trail for an auditor. External systems can pull the same timeline through the Runtime API (GET /api/runtime/v1/documents/{docId}/audit) — and reading the trail is itself audited.

Version Control

Studio ▸ Project ▸ Version Control — Git-style history, snapshots, and freeze governance for your project’s configuration (not its documents).

A card with a freeze-status chip floating top-right and a 3-tab group below it. The chip shows green Active (lock_open) or red Frozen (lock); its tooltip is “click to manage” and clicking it jumps you straight to the Governance tab.

┌───────────────────────────────────────────────────────────[ Active ]─┐
│  [ History ]  [ Snapshots ]  [ Governance ]                          │
│  ──────────────────────────────────────────────────────────────────  │
│  History:                                                            │
│   * a1b2c3d  amy@acme.com   2026-06-12 14:02  "tighten L2 gate"      │
│   * 9f8e7d6  bob@acme.com   2026-06-10 09:15  "add region filter"    │
│        └─ select a commit → diff panel + [ Rollback ]                │
│                                                       [ Commit… ]    │
└──────────────────────────────────────────────────────────────────────┘

Tab	Help	What it does
History	VC001	Lists configuration commits/tags (sha, author, timestamp). Select one to load a diff panel; supports Rollback and a Commit modal to record a new checkpoint with a message.
Snapshots	VC002	Export config snapshots — a compact export or a full/heavy one — tracks your recent exports, and lets you restore a configuration from a snapshot.
Governance	VC003	Freeze / Unfreeze the project. Freeze locks configuration; unfreezing opens a confirm modal. Shows a freeze audit log of every Freeze/Unfreeze event.

The freeze concept

Freezing a project marks its configuration as locked (FreezeConfig). Once frozen, the History and Snapshots tabs receive that flag and gate destructive actions — so nobody can quietly rewrite a configuration you’ve blessed for production. Unfreeze when you genuinely need to change it, then re-freeze. The chip is always visible on this page, so you can tell a project’s freeze state at a glance.

Tip. A good rhythm: commit at each meaningful config milestone, snapshot before a risky change (so you can restore), and freeze once a solution is stable and shipping.

Publish

Studio ▸ Project ▸ Publish — package the whole project as a reusable, published Solution / Template: a logo, name, description, tags, dashboards, and which Studio tabs appear in the template tour. The natural endpoint of the governance rhythm: version it, freeze it, then ship the blessed configuration. Where the package then goes — hubs, signing, installing — is V4 · Hubs & solutions.

Field	What it does / rules
Logo	Either upload an image (max 2 MB, max 1024×1024 px, validated in-browser) or pick one of up to 4 default images.
Solution Name*	Required, max 100 chars; letters/numbers/_, must not start with _.
Description*	Required; rich-text (bold/italic/links).
Tags	Up to 10 tags from suggestions or custom; at least 1 tag is required to Publish.
Overview Template	Binds a dashboard as the published overview (clearable).
Input form	Adds Publish Template form templates; drag to reorder.
How To Templates	Adds dashboards as “how-to” guides; drag to reorder.
Publisher Name	Your name or org (max 100 chars).
Template Setup Tabs	Choose which Studio modules and features ship in the template tour (see below).

Template Setup Tabs

Each subscription-enabled Studio module appears as a card with a parent slide-toggle; toggling the parent cascades to all its children. Clicking a module’s label opens a Module Feature Popup — chips All / Enabled / Disabled (with counts), a feature search, and a flat list of every nested feature, each with its own toggle. This is how you decide exactly which parts of Studio a recipient of your published solution will see. On save, three tabs are always appended — Overview, Configurator, How To — the template-tour defaults.

Draft vs Publish vs admin Update

Action	Who	What happens
Save (draft)	builder	Saves a draft (status Saved) — your work-in-progress publish config. Drafts auto-load next time you open this page.
Publish	builder	Publishes the solution live (status Active). Disabled unless the form is valid AND at least one tag is set.
Update	admin	When this same form is opened from the admin Solutions catalog (admin mode), the primary button becomes Update and the Publish button is hidden.

Under the hood. The exact same component runs in builder mode here and in admin mode from the Solutions admin catalog — which is why “Publish” (builder) and “Update” (admin) are the same screen with a different primary action.

Recap

• Activity = usage analytics (group by Session / Documents / Users / Stages, filter, export); Audit = the immutable compliance trail (Access / Create / Update / Delete / Download, plus exports and notification sends), actor-kind stamped, unrewritable, retention-by-policy, deep-linkable via ?filterquery=, exportable for auditors.
• The per-document Audit trail sheet (and its Runtime API twin) federates every store into one phase-grouped, actor-attributed timeline — with CSV export.
• Version Control = commits/diffs/rollback (History), export/restore (Snapshots), and freeze/unfreeze with its own freeze audit log (Governance).
• Commit at milestones, snapshot before risky changes, freeze what ships.
• Publish packages the whole project as a Solution — logo, tags, Template Setup Tabs; draft via Save, go live via Publish.

Where to go next

• V4 · Hubs & solutions — where a published Solution goes: the Hub, signing, and installing into another project.
• UC · Package & ship — the end-to-end packaging walkthrough.
• G1 · Access & roles — the roles whose actions this trail records.
• G4 · Observability — run traces: what the machine did, alongside what the users did.