What this chapter covers What is recorded, why it keeps accumulating on lower tiers, and why only admins can read it.
One day after rollout these questions arrive.
Settings → Audit log is where the answers live.
| Column | Meaning |
|---|---|
| Time | When |
| Kind | retrieval, tool_call, export and so on |
| Member | Who — a person or a service call, distinguished |
| Query | What was asked |
| Documents | How many were attached as grounding |
A most-cited documents list comes with it. That is more useful for operations than for audit — it shows what the team actually leans on.
This is the core of the design.
Collection always runs. The tier only shortens the viewing window.
| Tier | Window |
|---|---|
| Free, Plus | Screen locked (records still accumulate) |
| Pro | 30 days |
| Max | 365 days |
If collection stopped, an upgrade would only show data from the upgrade onwards — so "what happened during last year's incident?" could never be answered, and the reason to have an audit log disappears. That is why the locked screen says "available on a higher tier" rather than "no records".
The audit log is itself a disclosure path — raw queries and document names sit in it. So only owners and admins can open it; members do not even see the menu.
This is a question that comes up in security review: "who can read the audit trail?" needs an answer.
| Use | How |
|---|---|
| Incident investigation | Which document did the wrong answer come through |
| Compliance | Evidence for high-impact AI documentation |
| Improvement | Frequently cited documents, frequently failing queries |
| Cost | Which work consumes usage (alongside usage) |
This log records what happened inside this product. Tracing a whole agent system needs tree-shaped execution records, which is a separate topic — Audit trails and observability.
It is recorded. It just isn't visible. Upgrade later and that period appears.
Raw queries are stored, so it can. That is why reading is limited to admins. If queries in your workspace routinely contain personal data, turn on masking as well.
1. Why do records accumulate on lower tiers?
So the past is visible after an upgrade. Stopping collection would show only from the upgrade onwards, making old incidents impossible to investigate.
2. Why is the audit log admin-only?
Because raw queries and document names are in it, making the log itself a disclosure path.
3. What is the most-cited documents list for?
It shows what the team actually leans on. More useful for operations than audit — if that document goes stale, every answer goes stale with it.
Reconstruct last week from the log alone. Thirty minutes → Reconstruct a week from the audit log
HyperTeams"Where did this number come from?""Who opened that document?""Why did usage double last month?"