A post-incident review without a complete audit trail is guesswork. "Someone restarted the service" is not a useful finding. "Aditya Kumar ran the Restart API tile on the staging VibeDeck at 03:12 UTC, from IP 203.0.113.45, exit code 0" is.
VibeControls captures operations across the platform in a tamper-evident audit log. Session starts and stops, VibeDeck tile executions, configuration changes, webhook dispatches, scheduled job runs — logged with actor type (user, app, service, super_admin), actor identity, target resource, result, and timestamp.
The audit log is retained for 7 years with immutable batch logging; no plan tier or workspace admin can shorten the window. It is searchable and filterable from the Workspace Settings → Audit view. Filter by actor to see everything one engineer did in a timeframe. Filter by resource type to see all mutations on a particular agent. Export as JSON or CSV for SIEM ingestion or compliance reporting.
The per-operation detail shows full execution output, not just exit code. When the 3 AM restart audit trail shows success but the service is still down, you have the output to tell you why. Investigations that used to take 45 minutes of log-digging take 10 seconds.
Do it yourself
Investigate any operation in your workspace by opening the audit log, filtering it down to the exact actor or resource, inspecting full execution detail, and exporting the results for the record.
From your workspace, head to the Audit page to see the full trail of activity.
You should see: The audit log table loads alongside summary stats showing every captured operation across your workspace.
Ready to make this your story?
