admin-audit-log

When something goes wrong, "who changed that?" is the first question. Without a record, you cannot answer, and you cannot show a user how their data was handled. But an audit log that stores passwords or full personal data becomes its own incident.

Activate when

• Privileged actions exist (admin-authorization lists them) and are destructive or sensitive.
• Before launch of anything with staff/support access to user data, and whenever admin-dashboard adds destructive actions.
• Not when there are no privileged actions, and not to add analytics or product telemetry.

Working alone

This skill is self-contained. Its companions (declared in its metadata) are skills whose method it may need to do its own promised work. Use of a companion can be conditional: declaring one does not mean running it. When a companion's lane applies, use the skill if it is installed; if not, follow its short entry in references/companion-methods.md and say in your report which lanes ran inline at reduced depth. Never skip an applicable lane silently. Skills mentioned here only for escalation, referral, documentation, or optional deeper follow-up are not dependencies: report the hand-off and finish honestly.

Companions: admin-authorization.

Inspect