What was looked at, not just what was changed

A beacon records which screen a vendor employee opened, because navigation inside the app never reaches the server on its own.

What it is

A tiny component mounted once in the app shell that reports the current path plus hash route when it changes. It sends a path and a title and nothing else. The endpoint ignores anyone who isn't platform-side, so it is inert for customers.

Also called: screen views · did they open my contacts · read access log

See it
What was looked at, not just what was changed
Area
Operations
Group
Audit
System
Multi-Tenancy & Identity
Solves
3 named problems
01The hash route is included because the pathname alone is always the app root.
02A repeated path is not re-sent, so route changes that settle over several renders produce one row per screen.
03The request uses keepalive so a click that navigates away still delivers the row.
An audit row reading 'viewed Contacts' with a dwell time derived from the following event. src/app/platform/audit/page.tsx. Sample data — no customer information appears here.
How it works
  1. 1The hash route is included because the pathname alone is always the app root.
  2. 2A repeated path is not re-sent, so route changes that settle over several renders produce one row per screen.
  3. 3The request uses keepalive so a click that navigates away still delivers the row.
  4. 4The endpoint drops anything from a non-platform-side caller.
  5. 5Only platform-side users are recorded; a customer navigating their own account writes nothing.
Why we built it

The reason is stated in one line: 'API traffic says what they touched; this says what they READ, which is the half an audit of snooping depends on.' The scope is deliberately minimal, and the component says why: 'Deliberately dumb: it sends a path and stops. No timings, no scroll depth, no payloads. The audit question is did they open this customer's contacts, which a route answers, and anything richer would mean copying customer data into a second store to answer a question nobody asked.' The endpoint is equally candid about its own limits: 'Navigation has no server choke point… That makes this the one spot in the audit trail a determined person could withhold — so treat it as corroboration, not proof, and never as the sole basis for a conclusion. The API traffic underneath a page is still recorded either way.' Customers are excluded on purpose: 'A tenant navigating their own account is not what this log is for.'

The problem
  • Client-side navigation is invisible to a server-side log.
  • A change-only audit cannot answer questions about reading.
  • Richer telemetry would duplicate customer data into a second store.
Sound familiar?
What you get
The record covers reading, not only editing.
No customer data is copied into the audit store.
A screen opened just before navigating away is still recorded.

See it on your own jobs

Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.

or keep browsing features →