The gap
Authentication and session-security events - successful token refresh, detected credential theft, logout - are durably recorded in the audit log. They are not readable through any API surface.
Why
The only audit read endpoint is scoped to a single workspace. Authentication events are not workspace-scoped (a login or a detected token theft does not belong to one workspace), so they are recorded with no workspace and consequently match no workspace's audit query.
Impact
- A detected credential-theft event (
auth.refresh_reuse_detected) is the highest-signal security event the system produces, and there is currently no way for an operator to review it without direct database access
- The data is captured correctly and completely - this is purely a missing read path, not a recording gap
Proposed direction
A global, admin-only audit read endpoint covering non-workspace events, with the same keyset pagination and action/actor filtering as the workspace audit view.
Out of scope here
This is its own design effort - who may read it, how it paginates, how it filters, how it stays tenant-safe. Filed now so the seam is tracked rather than silent; not bundled into unrelated work.
The gap
Authentication and session-security events - successful token refresh, detected credential theft, logout - are durably recorded in the audit log. They are not readable through any API surface.
Why
The only audit read endpoint is scoped to a single workspace. Authentication events are not workspace-scoped (a login or a detected token theft does not belong to one workspace), so they are recorded with no workspace and consequently match no workspace's audit query.
Impact
auth.refresh_reuse_detected) is the highest-signal security event the system produces, and there is currently no way for an operator to review it without direct database accessProposed direction
A global, admin-only audit read endpoint covering non-workspace events, with the same keyset pagination and action/actor filtering as the workspace audit view.
Out of scope here
This is its own design effort - who may read it, how it paginates, how it filters, how it stays tenant-safe. Filed now so the seam is tracked rather than silent; not bundled into unrelated work.