Screens / Watching the work

Audit log

Record what the agent and the people did, searchable, exportable, and with retention that says what is kept.

For: Admins, security and compliance.

Markdown

3 ways to lay it out

1. Filterable table

Pick it when: The default: people look up events by who, what and when.

A filter bar over a table of events: time, who, what, and the thing it touched.

Audit logProThe account's audit log.
Filter chipsProActive filters as removable chips, with a clear-all.
Data tableProRows with search, sort and pages.
Relative timeFreeTimes people read, with the exact time on hover.

Install filterable table

Pro and Premium items need a licence key; free ones install as they are.

2. Timeline around one thing

Pick it when: Investigating one record, run or agent: everything that touched it in order.

A vertical rail of events with who did each and what changed.

Audit logProThe events.
Version historyProLive, draft and past versions, newest first.
Change hashProThe hash an approval was made against, so an event can be checked against the change it records.

Install timeline around one thing

Pro and Premium items need a licence key; free ones install as they are.

3. With export and retention

Pick it when: The owner needs to export, keep or delete what's recorded.

The log on the left and data controls on the right: export, how long it's kept, delete.

Data controlsProHow data is used, an export, deleting history, deleting the account.
Data retentionProHow long each kind of data is kept, and what happens after.
Type to confirmProDeleting is confirmed by typing a name.

Install with export and retention

Pro and Premium items need a licence key; free ones install as they are.

Rules that matter most here

Unknown stays unknown
An event the log couldn't record shows as a gap with the reason, not as nothing happening.
The agent is always named, by the app
Each row names the actor, an agent or a person, from your records.
Say what can and can't be undone
Deleting history says that it can't be undone and what it removes.

Already covered elsewhere

Pattern: Audit log UI for AI agents
Builds the whole screen with an agent route and a store: Audit data controls (Premium), with a -claude twin for the Claude Agent SDK.

Brief for a coding agent

Paste this into the agent that builds the screen. The docs MCP server returns the same text from get_screen.

Build an audit log with Candor UI: AuditLog over a filterable table of events (who, what, when, the thing it touched).
Use FilterChips for the active filters and RelativeTime for times, with the exact time on hover.
Name the actor on each row from your records: an agent by its role and name, a person by their account.
A period the log has no records for shows as a gap with the reason, not as an empty period.
For export, retention and deletion use DataControls and DataRetention; deleting uses TypeToConfirm and says that it can't be undone.
Start from the audit-data-controls block (audit-data-controls-claude for the Claude Agent SDK) for the routes and the store.
Read the ai-audit-log pattern for what to record.

Start from the "Filterable table" layout: A filter bar over a table of events: time, who, what, and the thing it touched.
Candor items: audit-log (https://candor.themethodic.com/docs/audit-log.md), filter-chips (https://candor.themethodic.com/docs/filter-chips.md), data-table (https://candor.themethodic.com/docs/data-table.md), relative-time (https://candor.themethodic.com/docs/relative-time.md).
Install: npx candor-ui add audit-log filter-chips data-table relative-time
Read each item's docs before using it and take its props from there; don't guess them. Pro and Premium items need the person's licence key, which they add with `npx candor-ui key <key>`; don't ask for it.