---
title: "Audit logs and access · Agent Wranglers"
url: https://agentwranglers.se/playbook/compliance/audit-logs-and-access
updated: 2026-10-20
licence: "All rights reserved"
---

# Audit logs and access

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Record who did what in a log nobody can change, and keep it for a set time. Prove every quarter that only the right people have access.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers compliance playbook: https://agentwranglers.se/playbook/compliance/audit-logs-and-access`.

## Required

- [Write an audit event for every sensitive action](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-events): Write one audit event for each action on a fixed list, with who, what, which record, when, from where and the result.
- [Make the audit log impossible to change](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-immutable): Store audit events where the app can only add and nobody can edit or delete. Chain each event to the one before with a hash.
- [Keep audit logs for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/audit-log-retention): Keep audit logs for a stated period, longer than debug logs, then delete them on schedule.
- [Review access every quarter](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/access-reviews): Every quarter, export every account and role from each system with production or customer data. Compare it with the staff list and remove extras within five working days.
- [Remove access within a day of leaving](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/offboarding-within-a-day): Disable every account of a person who leaves within 24 hours of their last day, and rotate any shared secret they knew.
- [Grant admin rights only for a set time](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/just-in-time-admin): Give nobody standing admin rights to production. Grant them on request, with a reason, for at most 8 hours, and log every grant.

## Recommended

- [Keep roles as code](https://agentwranglers.se/playbook/compliance/audit-logs-and-access/roles-as-code): Define which job gets which role in a file in the repository, apply it from there, and change access only through a reviewed pull request.

- Previous: [Breaches and reporting](https://agentwranglers.se/playbook/compliance/breaches-and-reporting)
- Next: [Controls and evidence](https://agentwranglers.se/playbook/compliance/controls-and-evidence)
- [All chapters](https://agentwranglers.se/playbook/compliance)