---
title: "Show who changed a record and when · Agent Wranglers"
url: https://agentwranglers.se/playbook/app-ui/sessions-and-permissions/record-history
id: APP-81
level: Recommended
applies: accounts
updated: 2026-10-22
build: a2a6bdfed830
tokens: 906
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Show who changed a record and when

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sessions and permissions](https://agentwranglers.se/playbook/app-ui/sessions-and-permissions.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22.

- ID: APP-81
- Level: Recommended
- Chapter: [Sessions and permissions](https://agentwranglers.se/playbook/app-ui/sessions-and-permissions.md)
- Rule: Show a history of changes on every shared record, such as an invoice or a customer. Each entry says who, what, when and the old and new values. Show only what the viewer may see.
- Check: A test changes a customer's email as one user and opens the history as another. The entry shows the first user, the time, the old and new email. A viewer without access to a hidden field sees the entry without its values.
- Applies when: The project has user accounts.
- How: When two people edit the same customer, the first question after a mistake is who changed it. Read the history from the audit events the server already writes, never from a second log the browser writes. Those events follow [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events.md). Show the newest change first, with the person's name and the time in the viewer's zone. Hide values the viewer may not read, such as a salary, and say that a hidden change happened. Security events for a person's own account belong in [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const history = await api.get(`/customers/${id}/history`);
renderHistory(history.map(event => ({
  who: event.actorName,
  when: formatDateTime(event.at, user.locale, user.timeZone),
  field: event.field,
  change: event.redacted ? 'Hidden' : `${event.before} → ${event.after}`,
})));
```

### Python example

```python
def customer_history(customer_id, viewer):
    events = audit_events(entity="customer", entity_id=customer_id)
    return [
        {"who": e.actor_name, "at": e.at, "field": e.field,
         "before": e.before if viewer.may_read(e.field) else None,
         "after": e.after if viewer.may_read(e.field) else None}
        for e in reversed(events)
    ]
```

## Related rules

- CMP-26 [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events.md) in Compliance and governance
- ACC-31 [Show people their own security log](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/security-activity-log.md) in Accounts and identity

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/app-ui/sessions-and-permissions/record-history">Agent Wranglers web app interface playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Sign out every open tab together](https://agentwranglers.se/playbook/app-ui/sessions-and-permissions/sign-out-all-tabs.md)
- [Sessions and permissions](https://agentwranglers.se/playbook/app-ui/sessions-and-permissions.md)