Audit log — every action every employee takes

A table, not a feed, because the questions asked of it are comparisons: what happened to this account, and what has this person been doing. Rows come from two sources — the platform activity stream (navigations, entries, reads, writes, refusals) and the change log (before/after diffs). Sessions are derived by grouping an actor's events with a 30-minute idle gap.

Also called: staff activity log · who opened my account · snooping audit · access trail · session log

1. 1Every platform endpoint passes through the capability gate, and every entry into a customer account passes through server auth — those two choke points do the writing, so nothing can be forgotten at a call site.
2. 2A diff view shows only the fields that actually moved, so a 40-column write reads as one line.
3. 3Default view is sessions ('this visit, 11 minutes, in that account, 3 edits'); the raw event feed is one click away for real investigations.
4. 4Identical repeated reads by the same actor on the same path collapse for a minute; writes, refusals and account entries are never throttled.
5. 5Filters: person, account, kind (viewed / entered / created / edited / deleted / refused / signed in), date range, staff-only.
6. 6The page renders 50 rows at a time because over months this table runs to hundreds of thousands of events.

• ◆Support entering a customer account left no record of what they read.
• ◆A changed field had no attributable author.
• ◆Read noise from routine dashboard polling buried the writes that mattered.