Audit Action Reference

Complete categorized reference of all audited actions in Thallus. Each action's details field contains action-specific JSON metadata. The examples below show typical detail payloads.

Authentication (9 actions)

Action When logged Example details
login User logs in successfully {"method": "password"} or {"method": "sso", "provider": "okta"}
logout User logs out {"method": "manual"}
login_failed Login attempt fails {"email": "user@example.com", "reason": "invalid_password"}
account_locked Too many failed login attempts {"email": "user@example.com", "failed_attempts": 5}
account_unlocked Admin unlocks a locked account {"target_user_id": "abc123"}
password_change User changes their own password {}
password_reset Admin resets a user's password {"target_user_id": "abc123"}
api_key_create User creates a new API key {"key_name": "CI pipeline", "prefix": "thal_G1x2"}
api_key_revoke User revokes an API key {"key_id": "abc123"}

Queries & Conversations (3 actions)

Action When logged Example details
query User sends a chat message {"mode": "research", "message_length": 142}
conversation_create New conversation started {"title": "Q3 analysis"}
conversation_delete Conversation deleted {"conversation_id": "abc123"}

Agent & Tool Operations (3 actions)

Action When logged Example details
tool_call An agent invokes a tool {"agent": "data_router", "tool": "query_database", "connection_id": "abc123"}
agent_execution An agent runs {"agent": "web_research", "plan_step": 2, "iterations": 3}
a2a_delegation Agent-to-agent delegation {"from_agent": "researcher", "to_agent": "data_analyzer"}

Orchestrator Operations (7 actions)

Action When logged Example details
llm_completion Direct LLM call (e.g., ask mode) {"model": "large", "tokens": 1250}
mode_detection Research mode auto-detected {"detected_mode": "research", "confidence": 0.92}
plan_created Execution plan generated {"steps": 4, "agents": ["web_research", "data_router"]}
plan_completed Plan finished {"steps_completed": 4, "total_steps": 4, "outcome": "success"}
replan_triggered Dynamic replanning decision {"reason": "incomplete_coverage", "new_steps": 2}
convergence_check Investigation convergence evaluated {"converged": false, "iteration": 3}
response_synthesis Final response synthesized {"citations": 5, "tokens": 2100}

Data Access (4 actions)

Action When logged Example details
data_query SQL/NoSQL query executed {"connection_id": "abc123", "query_type": "sql", "rows_returned": 42}
document_upload Document uploaded {"filename": "report.pdf", "size_bytes": 524288}
document_delete Document deleted {"document_id": "abc123", "filename": "report.pdf"}
document_search Document search performed {"query": "quarterly revenue", "results": 8}

Integrations (5 actions)

Action When logged Example details
email_read Email read via integration {"provider": "google", "count": 10}
email_send Email sent via integration {"provider": "google", "to": "user@example.com"}
calendar_read Calendar events read {"provider": "google", "count": 5}
calendar_write Calendar event created/updated {"provider": "google", "event_id": "abc123"}
contacts_read Contacts read {"provider": "google", "count": 25}

Memory (2 actions)

Action When logged Example details
memory_create Memory extracted and stored {"category": "PREFERENCES", "importance": 0.8}
memory_delete Memory deleted {"memory_id": "abc123"}

Webhooks & Tasks (2 actions)

Action When logged Example details
webhook_received Webhook event received {"source": "github", "event_type": "push"}
task_executed Background task executed {"task_type": "document_processing"}

Provider Connections (2 actions)

Action When logged Example details
provider_connect User connects an integration {"provider": "google", "auth_type": "oauth2"}
provider_disconnect User disconnects an integration {"provider": "google"}

Admin Operations (5 actions)

Action When logged Example details
user_create Admin creates a user {"target_email": "alice@acme.com", "role": "user"}
user_update Admin updates a user {"target_user_id": "abc123", "changes": {"role": "admin"}}
user_delete Admin deletes a user {"target_user_id": "abc123"}
account_deletion_requested User requests account deletion {"scheduled_for": "2026-03-08T00:00:00Z"}
account_deletion_cancelled User cancels deletion request {}

Workflows (17 actions)

Action When logged Example details
workflow_created Workflow created {"workflow_id": "abc123", "name": "Weekly report"}
workflow_updated Workflow modified {"workflow_id": "abc123", "version": 3}
workflow_deleted Workflow deleted {"workflow_id": "abc123"}
workflow_execution_started Workflow execution begins {"workflow_id": "abc123", "trigger": "scheduled"}
workflow_execution_completed Workflow execution finishes {"execution_id": "abc123", "nodes_executed": 5}
workflow_execution_failed Workflow execution fails {"execution_id": "abc123", "error": "timeout"}
workflow_node_execution Individual node executes {"node_type": "action", "node_id": "abc123"}
workflow_learning_event Workflow learning event recorded {"event_type": "performance", "workflow_id": "abc123"}
workflow_condition_locked Condition node locked {"node_id": "abc123", "reason": "evaluation_error"}
workflow_condition_unlocked Condition node unlocked {"node_id": "abc123"}
workflow_approval_requested Approval step triggered {"node_id": "abc123", "approvers": ["admin@acme.com"]}
workflow_approval_granted Approval granted {"node_id": "abc123", "approved_by": "admin@acme.com"}
workflow_approval_denied Approval denied {"node_id": "abc123", "denied_by": "admin@acme.com"}
workflow_approval_timeout Approval timed out {"node_id": "abc123", "timeout_hours": 24}
workflow_schema_drift Schema change detected {"connection_id": "abc123", "table": "orders"}
workflow_auto_healed Workflow auto-healed after drift {"workflow_id": "abc123", "changes": ["column_renamed"]}
workflow_tier_promotion Workflow promoted to higher tier {"workflow_id": "abc123", "from_tier": "draft", "to_tier": "active"}

Data Connections (7 actions)

Action When logged Example details
data_connection_created Database connection added {"connection_type": "postgresql", "name": "Production DB"}
data_connection_updated Connection settings changed {"connection_id": "abc123"}
data_connection_deleted Connection removed {"connection_id": "abc123"}
schema_introspection Schema discovery run {"connection_id": "abc123", "tables_found": 42}
column_pii_marked Column flagged as PII {"table": "employees", "column": "ssn", "pii_type": "SSN"}
column_pii_unmarked Column PII flag removed {"table": "employees", "column": "ssn"}
column_metadata_updated Column metadata changed {"table": "orders", "column": "status", "changes": {"description": "Order status"}}

Agent Settings (5 actions)

Action When logged Example details
platform_agent_settings_updated Platform-level agent settings changed {"agent": "data_router", "status": "deny"}
org_agent_settings_updated Org-level agent settings changed {"agent": "web_research", "org_id": "abc123", "status": "allow"}
group_agent_settings_updated Group-level agent settings changed {"agent": "data_analyzer", "group_id": "abc123", "status": "deny"}
user_agent_settings_updated User override set by admin {"agent": "web_research", "target_user_id": "abc123", "status": "allow"}
user_agent_override_updated User changes own tool preferences {"agent": "google", "tool": "google_send_email", "status": "deny"}

Data RBAC (6 actions)

Action When logged Example details
data_rbac_platform_updated Platform-level data access changed {"connection_id": "abc123", "table": "employees", "access": "deny"}
data_rbac_org_updated Org-level data access changed {"connection_id": "abc123", "org_id": "abc123", "access": "allow"}
data_rbac_group_updated Group-level data access changed {"connection_id": "abc123", "group_id": "abc123", "column": "salary", "access": "deny"}
data_rbac_user_override_updated User-level data access changed {"connection_id": "abc123", "target_user_id": "abc123", "access": "allow"}
data_access_denied Connection-level access denied at runtime {"connection_id": "abc123", "user_id": "abc123"}
data_table_access_denied Table/column access denied at runtime {"connection_id": "abc123", "table": "salaries", "user_id": "abc123"}

Other (1 action)

Action When logged Example details
other Uncategorized actions Varies