Skip to main content
You need an explicitly granted audit scope and sufficient clearance. Ordinary activity feeds and audit records serve different purposes.

​
Select the relevant activity

Open the permitted Console activity or audit view. Select the period, actor and affected resource for your question. Look for the operation concerned, such as a grant change, clearance assignment, review decision, publication, withdrawal or secret resolution. An activity notification helps you find work. It is not a substitute for the durable operation and audit record.

​
Inspect the audit record

  1. Confirm the actor, operation and recorded time.
  2. Check the subject identity and exact version where applicable.
  3. Inspect the execution principal and delegation record for delegated work.
  4. Follow linked decisions or publication records within your content authority.
  5. Record any missing or inaccessible part of the path.
Audit events are immutable. They can outlive their subject. A deleted resource does not make its earlier audit event editable. Secret-resolution records identify use and versions. They do not disclose the stored value.

​
Interpret missing results carefully

Check the selected filters, granted scope, clearance and retention period. An empty result only establishes that the permitted query returned no match. Audit access grants no ordinary access to customer content. A permitted record can therefore identify a subject that you cannot open through an ordinary resource page. Use Inspect audit events within a granted scope for scope and evidence handling. Operational consumer replay and queue health belong to the controlled System operations route.