# Read the audit trail

Find what happened, who did it, and under which authority, from the Console's Assurance section or from tanomis org audit.

The audit trail is the organization's record of decisions. Owners and admins read it in the
Console under Assurance, or page through it with `tanomis org audit`. Every entry names an actor, an
action, the tenant where relevant, and the decision.

- **Console → Assurance** filters by agent, decision, and plane, and opens the ledger entry.
- **`tanomis org audit`** pages the same trail from a terminal, newest first.
- Content is never in the trail: an entry references what a decision was about by hash.
- Members without the owner or admin role see an explanation instead of the trail.

## From the CLI

```bash title="Terminal"
tanomis org audit
tanomis org audit --limit 200
tanomis org audit --cursor "$NEXT_CURSOR" -o json
```

Use `-o json` in scripts; the cursor in the response continues the page.

## What you will find

| Family | Examples |
|---|---|
| Membership | Invitations sent, accepted, revoked; roles changed; ownership transferred |
| Access | Agent connector access enabled and disabled |
| Deployment | Versions registered, promoted, enabled, disabled, retired |
| Runtime decisions | Policy allow and deny verdicts, egress refusals, model refusals |
| Approvals | Permission requests, who answered, what they decided |
| Delegation | Each `agent.delegate` attempt, admitted or refused, with the authority chain |
| Support | Actions taken under a support grant, with the grant |

## Read one entry

An entry carries the principal that acted, the agent version where one acted, the run and session
ids where the action belongs to a run, the policy and decision, and hashes of any content the
decision was about. The run and session ids are how you get from an entry to the execution trace
and back; see [Traces and content classes](/guides/audit/traces-and-content-classes).

## From the Console

The Ledger tab of Assurance lists entries across the selected tenant with filters for agent, decision, and plane.
Selecting an entry opens the ledger record. Decisions shows the policy decisions on their own with
a link into the ledger entry for each; see [Policy decisions](/guides/audit/policy-decisions).

## Where to go next

- [Audit and evidence](/guides/audit/audit-and-evidence): what the ledger proves.
- [Export an auditor package](/guides/audit/export-an-auditor-package): handing the record to
  someone outside your organization.