SaaS Operation Audit Logs
SaaS Operation Audit Logs give organization owners a newest-first history of selected state-changing operations performed by authenticated users, plus organization-scoped MCP tool calls.
This page describes the organization-level Audit Logs page. For the automated workload optimization timeline, see Workload Autoscaler Audit Log.
Availability and access
Audit Logs are available automatically when the compatible CloudPilot AI SaaS components are deployed. There is no setting or feature switch to enable.
Only an organization Owner can view its Audit Logs. Other organization roles do not see the navigation item and cannot query the underlying history.
To open Audit Logs:
- Sign in to the CloudPilot AI Console .
- Select the organization you want to review.
- Select Audit Logs in the organization navigation.
The page always follows the selected organization and never combines history from multiple organizations.
What is recorded
CloudPilot AI uses an explicit allowlist of state-changing operations. The history includes operations such as:
- Organization configuration, invitations, member roles, and member removal
- Cluster deletion, upgrade requests, settings, and custom pricing
- Node Autoscaler configuration, NodePool and NodeClass changes, schedules, and rebalance policies
- Workload Autoscaler configuration and policy changes
- Organization-scoped MCP tool calls
Read-only Console/API requests, telemetry uploads, controller reports, personal user settings, and operations that make no effective change are not recorded. Organization-scoped MCP tool calls are recorded whether they read or change data.
Each row provides a concise summary:
| Field | Description |
|---|---|
| Time | Operation time in the browser’s local timezone, including milliseconds |
| Source | User for Console/API operations or MCP for MCP tool calls |
| Actor | Resolved user name or email when available, with a stable actor ID in the details |
| Action | Stable action code and a readable description |
| Resource | Safe resource type, name, and identifier when available |
| Result | Succeeded, Partial, Failed, or Denied |
Result values have the following meanings:
| Result | Meaning |
|---|---|
| Succeeded | The user operation or MCP tool call completed successfully |
| Partial | An MCP tool call returned a usable but incomplete result |
| Failed | The operation or tool call returned an error |
| Denied | Authentication or authorization rejected the user operation |
Select View on a row to open its details. Details can include the organization and cluster scope, request ID, duration, bounded error code, event ID, and allowlisted field changes. MCP events also identify the registered MCP client and tool.
Failed and denied user operations do not include before-and-after field changes. MCP events never include field changes or raw tool payloads.
Find an operation
Audit Logs initially show the latest seven days and load 50 events per page. Use Load older to append another page.
You can narrow the history with:
| Filter | Options |
|---|---|
| Time range | Last 1, 7, 30, or 365 days |
| Source | User or MCP |
| Result | Succeeded, Partial, Failed, or Denied |
| Action | One exact supported action |
| Actor ID | One exact stable actor ID |
| Search | Actor ID, MCP client name, tool, action, resource ID, or resource name |
The current browser view retains at most 500 matching events. If the loaded event limit is reached, narrow the time range or filters before continuing.
Data protection
Audit Logs store only bounded, allowlisted operational data. They never store:
- Request headers, IP addresses, or user-agent values
- Prompts, raw MCP arguments, or MCP responses
- Credentials, API keys, tokens, or secret values
- Arbitrary request or response payloads
For an approved field that can contain a secret, the event records only that the field changed. The before-and-after values remain hidden.
Events are retained for up to 365 days. This organization operation history is separate from the Workload Autoscaler Audit Log timeline.
Completeness and limitations
SaaS Operation Audit Logs are a best-effort operational history, not a WORM, tamper-proof, lossless, or compliance-grade ledger. Do not use them as the only evidence for regulatory, security, or formal change-control requirements.
Audit capture is isolated from product operations. If Audit Log storage is unavailable or its bounded in-process queue is full, the original user operation or MCP response continues normally and its audit event can be missing. History can also be incomplete during a mixed-version rollout.
The initial release does not include exports, SIEM integration, live streaming, charts, or configurable retention.
Troubleshooting
| Symptom | What to check |
|---|---|
| Audit Logs is not in the navigation | Confirm that the selected organization grants you the Owner role |
| No matching events appear | Clear the filters, expand the time range, and confirm that the user operation changed an allowlisted resource or the MCP call was organization scoped |
| Audit Logs are temporarily unavailable | Retry after a short interval; if the error persists, contact CloudPilot AI support |
| Loaded event limit reached | Narrow the time range, source, action, actor, or search filter |
Changing filters does not affect any CloudPilot AI resource. The Audit Logs page is read-only.