Admin Audit Log Review

Use this skill to convert admin audit log, privileged action, security evidence, retention, SIEM, and customer traceability questions into a concrete artifact with owners, gates, metrics, and recovery paths.

Workflow

1. Identify admins, privileged actions, enterprise requirements, data/security impact, retention needs, customer visibility, SIEM/export needs, and current logging gaps.
2. Read references/admin-audit-log-patterns.md.
3. Classify events as identity/admin, role/permission, billing, security, integration/API token, data export/delete, configuration, policy, support access, or system-generated change.
4. Define event contract, actor/target/context, retention, integrity controls, customer UI, export/API, alerting, privacy redaction, and support/audit workflow.
5. Produce audit-log design, state machine, decision table, event schema, coverage checklist, and rollout/backfill plan.

When not to use

• Do not use for generic advice the base model already handles without this skill's specific artifact contract.

Guardrails