Audit trail

connect0 keeps two complementary records: an account audit log of who changed what, and a per-run audit trail of what an agent did on each run. This page is a reference for both — where each lives and what each records.

Account audit log

Location: /a/<slug>/settings/audit.

A time-ordered feed of every state-changing action on the account, each row tagged with the actor that made it. It unions three sources you can filter by:

Source	Filter label	Records
connection	Connections	Connection add / rename / remove / refresh
acl	Access	Grants added, removed, or role-changed; teams; agent install / status / revoke
member	Members	Member added, removed, role-changed

Each row shows the event name, the subject it acted on, and an actor line: by <kind> <id>, plus on behalf of <kind> <id> when an agent acted for a human. Actors are principals — a human user or an operator — since agents cannot write access changes (see Access model).

Retention by plan

Writes are always on across every plan; only how far back you can read depends on your plan:

Plan	Read window
Free	Last 30 days
Pro	Last 90 days
Enterprise	Unlimited

On Pro and Enterprise, Download CSV exports the visible retention window.

Per-run audit trail

Location: the run's execution / thread view (open the run from your agent's activity).

Every agent run records its own audit trail — the model calls, tool calls, and lifecycle transitions in order. This is the first place to look when a run didn't do what you expected. Common lifecycle kinds:

Kind	Meaning
run.queued	Run accepted, waiting for a runner
run.started	Run began executing
run.finished	Run completed (successfully or not)
run.cancelled	Run stopped before finishing
run.budget_blocked	Run refused because a spend cap or the wallet blocked it
zero.action	An action taken by Zero, the connect0 assistant agent

Reading a finished run

A run.finished row with empty unit counts means the run finished without any model call — a dispatcher short-circuit (for example a missing platform key or no runtime model), not model work that failed mid-thought. The run's first message names the guard that fired. See Why did my agent run fail? for the full decision tree.

Which record do I want?

• "Who granted this agent access to that connection?" → account audit log, Access filter.
• "Why did last night's run produce nothing?" → per-run audit trail.
• "Did a payment or member change happen?" → account audit log, Members / Connections filters.