Activity and audit records

Passport keeps two separate records:

• Activity records calls made through Passport.
• Admin activity records privileged workspace changes.

Keeping them separate makes it clear whether an event came from an AI client or from an administrator changing the workspace.

​

Your Activity

Everyone can open Activity to see their own calls. A row shows the app, action, AI client, outcome, and timing.

• Allowed means the call completed.
• Blocked means access, Safety, an approval, or a guardrail stopped it.
• Error means the call was allowed but did not complete successfully.

​

Workspace Audit

On Enterprise, admins open Audit to review calls across the workspace. Filters cover person, app, team, and outcome. Filtered views have shareable URLs, and Guardrail findings can open the relevant view. Passport CLI may add an optional via CLI label so the record can distinguish tools such as Codex and Claude Code. That label is self-reported; the signed-in person or agent and the client policy remain authoritative.

​

Admin activity

Open Settings → Admin activity on Enterprise to review changes such as:

• approving or removing an app;
• changing a role or team;
• creating or editing a guardrail;
• changing client policy; or
• generating or revoking a SCIM token.

Each entry records the actor, action, target, time, and a concise description of the change.

​

Export

Every plan lets an admin download a full workspace backup. On Free and Pro, use Settings → Workspace essentials → Manage workspace → Advanced. On Enterprise, use Settings → Workspace backup. A backup is for recovery and support, not for security monitoring.

​

Stream to your SIEM

Enterprise can stream both record types to a SIEM over HTTP or to an OpenTelemetry collector. See SIEM and OTLP export.