Audit trail

DioscHub keeps records at three points a reviewer usually asks about: who changed the configuration, who erased data, and who approved a sensitive action. The first two are reviewable trails you can query; the third is written as it happens. This page is precise about which is which, so you know what you can pull and what you cannot.

Administrative actions are recorded and queryable

Every change an administrator makes to a deployment’s configuration is written to an admin audit trail. That covers creating, updating, and deleting assistants, Roles, MCP instances, Toolsets, models, knowledge bases, and approval settings, along with configuration export, import, and settings changes.

Each entry records:

Who — the administrator, or the admin API key, that made the change.
What — the action and the entity it acted on.
Before and after — the prior and new values for the change.
Outcome — whether it succeeded, and the error if it did not.

This trail is queryable through the admin API — by recent activity, by the entity that changed, or by the administrator who made the change — so you can answer “who changed this, and when” for any part of the configuration.

Data erasure is recorded and queryable

Erasure is audited on its own trail. Both the subject-access searches an operator runs and the erasures they execute are recorded, and that trail is queryable through the admin API. So an erasure you perform to satisfy a request leaves its own reviewable record of what was searched and what was removed. See Data erasure & GDPR.

Neither audit trail carries a chat user’s credentials or message content — they record administrative and erasure actions, keyed to the administrator who performed them.

Approval decisions are written as they happen

When a user reviews a gated tool and approves or rejects it, that decision is written to an append-only approval log at the moment it is made. Each record captures the tool, its arguments, the decision, and — for an update — the before-state of the change. The user’s forwarded auth is not recorded; it is written as empty, keeping the log credential-blind.

The admin dashboard surfaces how many approvals are currently awaiting a decision, so an operator can see when work is waiting. Approvals that still need a human are the actionable signal the dashboard raises.

Next: Data erasure & GDPR.