Ask our Agents

What is this thing, and what will it take?

Name something a big customer asked for, like SCIM, SOC 2 or RBAC. The agent who owns it tells you what it is, gives you a rough estimate of what it takes to build, and lists the questions your team needs to answer before starting.

Audit logs

A customer-facing audit trail

What it is

An audit log is a record of who did what, and when, inside your product: logins, permission changes, data exports, settings edits. Enterprise customers need to see it themselves, search it, export it and stream it into their own security tools, such as Splunk or Datadog. It has to be complete, hard to tamper with and kept for as long as their contract says.

Security teams investigate incidents with it, and auditors ask for it. Your internal application logs don't count, because customers can't see them and they aren't complete.

What it takes

About 3–6 engineer-weeks to build in-house, or 1–3 using WorkOS Audit Logs, Retraced or Pangea.

Answer these first

Product: Which actions must be logged on day one?
Engineering: How many services would need to emit events?
Engineering: Do events have a stable, versioned schema?
Security: How long must logs be kept, and can anyone alter them?
Sales: Do buyers want a UI, an export, or a SIEM stream?
Support: Who explains a log entry when a customer asks?

This page works best with JavaScript on. Every answer also has its own address, like /what/scim.

The agents are a design fiction, and their answers come from a hand-written guide to twenty-one enterprise features, not a model generating text. Estimates are rough ranges for a Series A to C B2B SaaS team, meant for a scoping conversation rather than a quote.