What it means
Most businesses already have audit logs, several of them: one per product, each with its own format, its own clock and its own idea of who a user is. One audit log means a single trail across the whole system, in which a person’s edit, an automation run and an AI action are recorded the same way and can be searched together.
It is not the same as an activity feed. A feed tells colleagues what changed. An audit log has to stand up later, so it records who acted, under what authority, and what the record looked like before.
Why it matters when you choose software
An audit log earns its keep on a bad day: a disputed invoice, a deleted contact, a customer asking who opened their file. Answering across five trails means exporting, matching user names and lining up timestamps, and the answer arrives days later with gaps in it.
AI raises the stakes. Once software can act for people, you need to be able to ask what it did, on whose behalf, and put it back.
Questions to ask a vendor
- Do human, automation and AI actions all write to the same log?
- Does each entry record the actor, the authority it acted under and the before-and-after state?
- Are actions taken through the API, and by the vendor’s own support staff, logged too?
- Can a change be reversed from the log, or only read there?
- How long are entries kept, and can we export them?
How Cyril approaches it
In Cyril every module writes to one audit log. Each entry carries the actor, the authority it acted under, the before-and-after state and a timestamp from one clock, and agent actions are marked as such. Calls through the REST API and the MCP server act as a person and land in the same log, as do actions by Cyril’s own support team. Changes go through one soft-deleting write path, which is why a change made by Ask Cyril comes with an undo.