# Review the Audit Log > For the complete documentation index, see [llms.txt](https://docs.redpanda.com/llms.txt). Component-specific: [agentic-data-plane-full.txt](https://docs.redpanda.com/agentic-data-plane-full.txt) --- title: Review the Audit Log latest-operator-version: v26.2.1 latest-console-tag: v3.10.0 latest-connect-version: 4.104.0 latest-redpanda-tag: v26.2.1 docname: audit-log page-component-name: agentic-data-plane page-version: master page-component-version: master page-component-title: Agentic Data Plane page-relative-src-path: audit-log.adoc page-edit-url: https://github.com/redpanda-data/adp-docs/edit/main/modules/monitor/pages/audit-log.adoc description: Review authorization decisions across Agentic Data Plane, filter events, and inspect who acted on which resource and whether the request was allowed. page-topic-type: how-to personas: security_compliance_lead, platform_engineer learning-objective-1: Filter authorization events by time, outcome, subsystem, or search term learning-objective-2: Inspect the actor, action, resource, source, and policy behind an authorization decision learning-objective-3: Choose the audit log or a transcript for an investigation page-git-created-date: "2026-08-04" page-git-modified-date: "2026-08-10" --- The audit log records authorization decisions across Agentic Data Plane. Use it to answer who performed an action, which resource they acted on, where the request came from, and whether the request was allowed or denied. After reading this page, you will be able to: - Filter authorization events by time, outcome, subsystem, or search term - Inspect the actor, action, resource, source, and policy behind an authorization decision - Choose the audit log or a transcript for an investigation > 📝 **NOTE** > > The audit log is a preview capability. Access to the page is granted per organization, and audit recording is enabled per deployment; the two are independent. If you don’t see **Audit Log** in the sidebar, it isn’t enabled for your organization. > > A deployment can therefore show the page with no recorded events. If the table is empty for a period you know had activity, see [Troubleshooting](#troubleshoot-the-audit-log). ## [](#prerequisites)Prerequisites Your account needs the `dataplane_adp_auditlog_list` permission to open the audit log and view event details. Outside the Admin role, audit log reads come from an [access policy](https://docs.redpanda.com/agentic-data-plane/control/access-policies/) naming `Action::"AuditLog.list"`. See [Audit log permissions](https://docs.redpanda.com/agentic-data-plane/control/permissions-reference/#audit-log-permissions). > ❗ **IMPORTANT** > > Audit events can include user identities, resource names, network information, configuration changes, and captured request or response data. Grant audit log access only to people who need it, and review events before sharing them. ## [](#open-the-audit-log)Open the audit log 1. Open **Audit Log** in the sidebar. 2. Review the most recent events. The default time range is Last 24 hours. 3. Select a row to open its details. The table shows these fields: | Field | Description | | --- | --- | | Actor | The user accountable for the action. When an agent or another identity acted for the user, the table also identifies that caller when available. | | Subsystem | The part of Agentic Data Plane that handled the action. | | Action | The operation and service involved. | | Resource | The type and identifier of the affected resource. When one call decided on more than one resource, this shows a count, such as 3 resources, and the detail panel lists each resource with its own decision. | | Outcome | Whether the authorization decision allowed the action, denied it, or, for a call that decided on more than one resource, allowed some resources and denied others (Partial). Hover over the outcome to see the deciding policy when available. | | Time | When the decision occurred. | ## [](#filter-events)Filter events Use the controls above the table to narrow an investigation: - **Search**: Match a keyword against the event messages. - **Actor**: Enter an exact actor identity, such as an email address, to show only that actor’s events. - **Resource type**: Enter a full namespaced resource type, such as `redpanda.agent`, to show events for that type. Matching ignores case. The table’s Resource column shows the type without its namespace prefix, so `redpanda.agent` appears as `agent`. - **Resource ID**: Enter an exact resource identifier to show events for a single resource. Matching is case-sensitive. - **Outcome**: Show allowed actions, denied actions, or partial outcomes. Select more than one to combine them. - **Subsystem**: Select one or more of Management API, LLM proxy, MCP gateway, A2A proxy, and Spending. - **Time range**: Choose a duration of Last hour, Last 24 hours, Last 7 days, Last 30 days, or All time. To review a past window, set an end time, and the duration counts back from that time instead of from now. Filters work together. For example, select Denied, choose MCP gateway, and set Last hour to investigate recent MCP authorization failures. ## [](#inspect-an-event)Inspect an event Select an event to open its detail panel. The panel identifies the actor, outcome, subsystem, operation, resource, deciding policy, source, and time when that information is available. When a call decided on more than one resource, the panel opens with a Resources section that lists each resource and its own decision. Select a resource to see its individual outcome and deciding policy in the panel. Depending on the action, the panel may also show: - The agent or caller that acted for a user - The event class and activity - A configuration change with before and after values - Captured request data - Response status, error, or captured response data Captured values may be redacted, truncated, or absent. An empty field does not mean that no activity occurred. Use the event summary and outcome as the primary record of the authorization decision. ## [](#audit-log-compared-to-transcripts)Audit log compared to transcripts Use the audit log for access and accountability questions: - Who attempted an action? - Which resource and subsystem were involved? - Was the action allowed or denied? - Which policy made the decision? Use [transcripts](https://docs.redpanda.com/agentic-data-plane/monitor/transcripts/) for execution questions about an agent conversation, including model turns, tool calls, errors, timing, and token usage. An investigation may need both views: start with the audit log to identify an authorization decision, then inspect the related agent activity when you need execution details. ## [](#troubleshoot-the-audit-log)Troubleshoot the audit log | Issue | What to do | | --- | --- | | Audit Log is missing from the sidebar | The preview may not be enabled for your organization. Contact your Redpanda representative. | | You cannot open the audit log | Ask an administrator to confirm that your account has dataplane_adp_auditlog_list, from the Admin role or from an access policy naming Action::"AuditLog.list". | | No events match | Clear the search and filters, then widen the time range. The default view includes only the last 24 hours. If the table stays empty, audit recording may not be enabled for this deployment yet; page access and recording are gated independently. | | An event has no request, response, or configuration details | Not every event includes these fields. Use the event’s actor, action, resource, outcome, and time to continue the investigation. | ## [](#next-steps)Next steps - [How Redpanda stores audit events](https://docs.redpanda.com/agentic-data-plane/monitor/concepts/#how-redpanda-stores-audit-events) - [Transcripts compared to audit logs](https://docs.redpanda.com/agentic-data-plane/monitor/concepts/#transcripts-compared-to-audit-logs) - [See What Your Agent Did](https://docs.redpanda.com/agentic-data-plane/monitor/transcripts/) - [Control Who Can Do What](https://docs.redpanda.com/agentic-data-plane/control/permissions-overview/)