What is an audit log?
A record of every change and who or what made it, so any action can be traced back and undone.
Audit log — An audit log is an append-only record of who did what and when in a system, including actions taken by API tokens and AI agents. It is what lets a team reconstruct and reverse an unwanted change.
Why it matters
A record in a CRM can be edited by a person clicking a field, by an integration pushing an update, or by an AI agent acting on its own. Without a log, a changed field just looks different from yesterday, with no way to know why. An audit log fixes that by writing one entry every time something changes: what changed, what it changed from and to, who or what made the change, and when.
The entries have to be append-only, meaning nobody, including an admin, can edit or delete a past entry, or the log stops being trustworthy as evidence. The log is also the mechanism that makes an agent's actions reversible: if an agent updates the wrong field on two hundred records, the log is what shows which two hundred and what the value was before. A log that only tracks people and skips agents and tokens is missing the entries a team is most likely to need, because automated actions happen at a volume no person could review by hand.
How an audit log works
- 1
An action happens
A person edits a record, a token calls an API, or an agent executes a tool call.
- 2
An entry is written
Actor, action, before and after values, and a timestamp, appended to the log.
- 3
The entry cannot be edited
Append-only storage means the log stays trustworthy as a record of what actually happened.
- 4
A person can query it
By record, by actor, or by time range, to answer 'what changed and who did it'.
- 5
A bad change can be traced and reversed
The before-value in the log tells a person what to restore.
The mistake to watch for
Questions
- How is an audit log different from an activity timeline?
- An activity timeline is usually a human-readable summary shown on a record, useful for catching up on a contact. An audit log is the underlying append-only data store built for tracing and reversing changes, including ones a timeline might not surface.
- Should every field change be logged?
- Every change that could need reversing or explaining should be. That includes agent and token actions, not only the ones a person made by hand.
- Can an audit log entry ever be deleted?
- No, not by design. Append-only means past entries are never edited or removed, which is what makes the log usable as evidence when something needs to be reconstructed.