Everything that changes state in Shellius — and every access decision — writes an audit entry: who did it, what it touched, when, and from which address. Entries are append-only. There is no update or delete path in the application.
Required permissions
| Permission | Lets you |
|---|---|
audit.view | Read and filter the audit log. |
audit.export | Download the log as CSV or JSON. |
Find an event
- Open Audit log.
- Narrow by action, actor, resource type or a date range, or use the search box.
- Expand a row to see the entry's metadata.
Useful actions to know:
| Action | Written when |
|---|---|
access_request.approved | An approver approves a request. |
access_request.prod_bypass | Someone with access.prod_bypass skips review on a production server. The request is still created, and approvers are notified. |
session.attach / session.detach / session.end | A browser terminal is attached, left running in the background, or ended — with the reason. |
Export
- Set the filters you want — the export honours the same filters as the list.
- Choose Export, then Export as CSV or JSON.
Keep a copy elsewhere
The log lives in PostgreSQL. It is only as durable as your database backups, and an attacker with database access is outside what the application can protect against. Export on a schedule, or ship your database backups off the host — see Backup and restore.