Verify and export the audit trail

Every change in Maliru writes an audit event in the same step as the change itself: who did it, to which record, what changed, and when. The Audit trail tab in Evidence & audit is where you read that history, check that it is intact, and take a copy for an auditor or a dispute.

You need the View audit trail permission. Without it the tab doesn't appear.

Finding events

• Search events matches the event name, the kind of record, and the person or process that acted.
• Event type narrows the list to one kind of event, for example a form being submitted or a permission being granted.
• Clear filters resets both, and Refresh reloads the list.
• The columns are When, Event, Actor and Subject. Events done by Maliru itself, such as a scheduled update going out or a request being confirmed automatically, name the process as the actor.
• The list is newest first and ends with a pager: Rows per page 25, 50, 100 or 200, with Previous and Next.

Reading an event

Click an event to open it. It shows "Event #{id}", the Actor, When and Subject, then:

• What changed: the details recorded with the event, or "No detail recorded."
• Event hash: the event's fingerprint, with Copy hash to paste it into a report or an email.
• View subject timeline: the full history of that one record, with its audit events and evidence together. Older entries load in batches ("More history is available").

The same View subject timeline button is on each row of the Evidence tab.

Checking the chain is intact

Each audit event is sealed with a SHA-256 hash that includes the hash of the event before it. Changing or removing any past event would break every link after it.

The strip above the list checks this:

• Before you run it, it reads "Integrity not checked", with "Verify the workspace audit trail."
• Verify integrity walks the whole workspace chain, oldest first, recomputing every hash.
• A clean result reads "Integrity verified · {n} events checked", with the time it was checked.
• A problem reads "Audit chain broken" and names the first affected event: "First affected event #{id}."
• If the check itself couldn't run, the strip says "Integrity could not be checked" and offers Retry.

The check always covers every event in the workspace, whatever filters you have applied to the list. If you ever see Audit chain broken, don't change anything further and contact Maliru support with the event number.

Exporting an audit report

Export report in the page header opens Export audit report. Under "Included in this PDF" it lists:

• Scope: Current page, with the Page number and the number of Events.
• Event type and Search: the filters in force.
• Verification: the result of the last integrity check.

"The report includes the events on this page and the current verification result." Choose Export PDF. The report lists When, Event, Actor and Subject for each event, and follows your workspace's PDF branding.

To export more than one page, raise Rows per page to 200 first, or export each page in turn. Run Verify integrity before exporting so the report carries a fresh result.

What the trail isn't

• It can't be edited or deleted by anyone in the workspace, owners included.
• It records actions and the details needed to follow them. It isn't a store of files or documents: those stay in Evidence.
• Reading the trail doesn't give access to the records it mentions. Opening a subject still follows that record's own permissions.

See Evidence and the audit trail for the Evidence tab and how files are stored.