> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amnify.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Activity and audit trail

> The complete, tamper evident record of everything that happened in your organization.

Every change to your organization's data is captured with who did it, when, what changed and why. That includes every action an agent took on your behalf. The design goal is a record that holds up under audit, not just under curiosity.

## The feed

A chronological ledger showing **what happened** (a finding suppressed, a source connected, a review completed, a question answered), **what it happened to**, **who caused it**, and **the change** as a readable before and after.

Filter by domain, actor, date range and target. Domains are findings, sources, automation, penetration tests, users, pull request reviews, CVE disclosures and context.

## A record's own history

Every finding also carries its trail on its own page: first seen, every status change and who made it, every question asked and answered, and every remediation attempt.

The feed and the per record trail are the same ledger read two ways. An act touching many records is recorded on each of them, so each record's history is complete, while the feed shows the single meaningful entry so it stays readable.

## Two layers

**Evidence.** One entry per change to any tracked record: what changed, the full before and after state, who caused it, and a hash for tamper evidence. It is append only. It cannot be updated or deleted, and the only way it disappears is when the whole organization is deleted.

**Interpretation.** The readable version: a named action, the target, the cause, and a plain diff.

If the two were one thing, correcting a mislabelled event would mean editing history. Keeping them apart means the evidence is written once and never touched, while the way it reads can be improved forever.

## The actor

| Actor    | Meaning                                                            |
| -------- | ------------------------------------------------------------------ |
| Person   | A member of your organization                                      |
| Agent    | Work Amnify did, linked to the run that did it                     |
| Schedule | A scheduled occurrence                                             |
| Webhook  | An event from a connected system, such as a push or a pull request |
| System   | The platform itself                                                |

Work is attributed where it was **caused**, not where it executed. A scan a person started and a worker ran hours later is still attributed to that person, and a scheduled scan is never attributed to whoever happens to be logged in.

Actors are stored as identifiers, never as names, so someone changing their name never leaves a stale label behind.

## What is recorded

Findings, sources and scopes, automation and schedules, penetration tests, pull request reviews, dependency disclosure checks, context and decisions, and organization membership. The ledger can be exported for an audit or a review.