History

0 entries were read platform-wide on this request and 0 of them belong to this organisation. The read did not reach its ceiling, so nothing of this organisation's is beyond it.

Actor — role on every line; stable Entra object id on attributed AI and governed transitions. The object id is erasable and the erasure fence prevents an in-flight request from writing it back. Work addresses remain withheld from this screen. A system or batch act says so and carries no invented person.

Action, object and timestamp — carried. The action as it was stored, the object it was done to, and the moment it happened. Where the entry can be resolved back to an object that still exists, the object is a link; where it cannot, it is not given one it could not honour.

Before and after — carried for one family of acts, and honestly absent for the rest. Lifecycle changes store their own transition and it is rendered as a real before-and-after. Nothing else does. Those rows say "not captured", which is true, rather than showing a diff assembled at render time from the current value and a guess. A fabricated before-and-after in an audit trail is worse than none: it is the one column an auditor will test.

Source — carried for every external AI request from this build. Older and non-AI writers may still show “not recorded”; that is an explicit gap on those rows rather than a source guessed from their action text.

Prompt and answer content — deliberately not retained. Each external request records a domain-separated SHA-256 fingerprint, character and item counts, purpose, source surface, intended and actual provider/model, boundary, fallback state, latency and token counts. Those facts prove which prompt bytes were used when the same bytes are presented for verification, without turning the audit register into a second store of customer documents, emails or conversations.

Two entries in every hundred carry a colleague's address in their own stored text — the sponsor-approval line and the licence-reroute lines both write one. This page removes them before rendering and publishes the count above, because a redaction a reader is not told about is indistinguishable from data that was never collected.

Retention. Nothing here expires and nothing is deleted; the register is append-only and no surface in this product offers a delete. What is bounded is the READ: it returns the newest 500 entries across the whole platform, and this page keeps yours from within that. So this page shows your organisation's acts inside a platform-wide window rather than your complete history, and the panel above says which of the two you are currently looking at.