Authenticate
TOTP two-factor or OIDC or SAML SSO proves who's knocking. SCIM provisions and deactivates admins straight from your IdP.
Enterprise security · by design
Trust every layer, not just the login.
OpsIQ protects the complete operating surface: people and identities, application code, secrets and customer data, APIs and webhooks, connector packages, AI actions, support channels and incident evidence. Sensitive operations are scoped, authorised, verified and made accountable from request to result.
OIDC · SAML · SCIMGoverned code & connectorsHMAC-SHA256 signed I/OTamper-evident audit chains
OPSIQ SECURITY EDGE
ENFORCEMENT ONLINE
ILLUSTRATIVE CONTROL FLOW
WORKSPACE · ACME-PROD
POLICY · ZERO-TRUST
AUDIT CHAIN · VERIFIED
LIVE REQUEST INSPECTIONrisk / 100
POST
/admin/login203.0.113.42 · new device · burst pattern
92
POST
/api/v1/tickets/replyscoped bearer key · workspace matched
08
TAMPER-EVIDENT EVENT CHAINappend only
08:45:31auth.login.blocked · 203.0.113.42DENIED
08:45:32api.scope.verified · tickets:replyPASS
08:45:32audit.checkpoint · chain linkedVERIFIED
CRYPTOGRAPHIC PROOF
HMAC signature verified
sha256=8a41…b90f · nonce accepted
✓ timestamp fresh · replay rejected
Identity · code · data · AI
Controls become reviewable evidence
Live
Secretboxauthenticated secret storage
CSRF + CSPbrowser-facing protection
HMACSHA-256 signed I/O
Hash chainaudit integrity verified
Authentication & access
Authenticate, authorize, audit.
Only the right people get in, and high-risk actions verify them again. TOTP and recovery codes protect local sign-in; OIDC or SAML connects enterprise identity; SCIM governs joiners and leavers. Password policy, breached-password screening, IP and account lockouts, new-device alerts, device revocation and step-up confirmation protect the space between first login and a sensitive change.
TOTP two-factor: per-admin, with single-use recovery codes you can regenerate.
OIDC, SAML & SCIM: connect enterprise identity, domain rules and lifecycle provisioning.
Defence after login: breached-password screening, lockouts, new-device review and step-up verification.
2FA challengeVerifying
ThenRole-gated & logged
Authorize
Owner / admin / support roles plus per-page grants mean each person reaches exactly what their job needs, nothing more.
Audit
Security events and registered human or AI actions carry actor, IP, time and result through a tamper-evident audit chain.
The core controls
Four guarantees, working at once.
Every request moves through the same security choreography: prove identity, prove authority, sign the path, seal the data. The result is a platform that feels fast without ever becoming casual about access.
Authenticate
TOTP two-factor, OIDC or SAML SSO and SCIM joiner/leaver flows verify who is entering before any admin surface opens.
Authorize
Owner, admin, support and page-level grants keep every teammate inside the exact boundary their role allows.
Sign
Webhook traffic and API calls are scoped, HMAC-verified, replay-protected, rate-limited and tied to one workspace.
Audit
Security events and registered AI or admin actions land in a tamper-evident, workspace-scoped audit chain.
OpsIQ security control plane live verification
Security Overview
Ask Security
Incidents
monitoring
Active IP blocks12firewall now
Auto-blocked · 7d38policy enforced
Failed logins · 24h062 identities
High-threat · 7d04sessions reviewed
Login attacks & blocks · last 14 days
Event feed
Refresh
Export
RiskSourceSecurity eventDecisionWhen
High45.137.x.x
datacenterRepeated login failures
threshold crossed · IP/CIDR policyBlocked
datacenterRepeated login failures
threshold crossed · IP/CIDR policyBlocked
Review102.89.x.x
residentialHigh-threat visitor session
bot + takeover signalsQueued
residentialHigh-threat visitor session
bot + takeover signalsQueued
InfoOIDC
workspace IdPAdmin sign-in succeeded
role and workspace verifiedLogged
workspace IdPAdmin sign-in succeeded
role and workspace verifiedLogged
ChainAudit
ledgerIntegrity checkpoint verified
tamper-evident chain intactValid
ledgerIntegrity checkpoint verified
tamper-evident chain intactValid
Security event feed · attackers, incidents and integrity checks
Latest blocked attacker
The firewall classified the source, crossed the failed-login threshold and added the address to the active block list.
IP: 45.137.x.xclass: datacenterresult: blockedchain: verified
Important actions leave evidence.
Registered AI actions, admin changes and webhook deliveries can be recorded with actor, IP, action, result and approval state.
AI actions loggedCSV exportOwner-only historyChain verified
Every edge call proves itself.
HMAC signatures, nonces, timestamps, scoped keys and optional IP allowlists stop forged or replayed traffic early.
Built for bad traffic.
Failed-login lockout, IP and CIDR blocking, bot scoring, rate limits and account-takeover signals keep pressure off the core.
Tenant isolation
Every request carries its workspace boundary.
Workspace and site identifiers are enforced through access checks, API-key scopes, connector ownership and audit ownership, keeping one customer request from being resolved inside another customer's context.
Workspace Alphascope: alpha_7f...
Workspace Beaconscope: beacon_42...
Workspace Corescope: core_19...
Ten connected layers
Security every place data lives or moves.
Identity security
TOTP, recovery codes, OIDC and SAML SSO, SCIM provisioning, password policy, breached-password screening, new-device review and step-up verification.
Authorization
Owner, admin, support and granular grants meet action scopes, confirmation policies and workspace boundaries before a protected operation proceeds.
Secret & data protection
Sensitive values use authenticated encryption with installation-bound key material and unique nonces. Interfaces redact stored values and support rotation.
Posture, live · responsible AI
A control plane that checks itself.
OpsIQ's AI cannot invent operations. Every action it can take is a registered contract with declared scope, roles and parameters, and anything off-contract is rejected at the brain layer before it reaches an endpoint. Risky writes require explicit human confirmation. You choose the provider or self-hosted deployment; data handling follows that selected provider and deployment policy, while OpsIQ does not use workspace content to train its own models.
Action approval gating. Risky writes need a human confirmation.
No off-contract actions. Unknown operations are rejected at the brain layer.
Choose your deployment: provider or self-hosted, with its data policy visible to the workspace.
AI ACTION GATEENFORCEMENT ACTIVE
REQUESTED OPERATION
OpsIQ Writing · proposed action
Refund invoice #INV-2291
action.refund_invoice · workspace/acme-prod
✓
Registered action contractKnown endpoint and declared parameter schema
PASS✓
Role and workspace scopeBilling operator · current workspace only
PASS✓
Parameters validatedInvoice exists · amount within policy
PASS!
Risky write requires a personThe model cannot approve its own financial action
REVIEWHuman confirmation requiredApprover identity and result will enter the audit chain.
unknown.action.execute_shellREJECTED OFF-CONTRACT
ACTOR
billing.operatorSCOPE
invoice:refundRESULT
awaiting approval
billing.operatorSCOPE
invoice:refundRESULT
awaiting approval
Loggedregistered AI actions
0off-contract actions allowed
Yourmodel, keys & data
Visibleprovider data policy
Encrypted backup & recovery
One sealed file. The whole installation.
A full OpsIQ backup can move or restore the installation without turning its most sensitive material into an ordinary archive. The worker streams bounded chunks into a sealed .opsiqx container, then restore verifies the file before any import is applied.
Recoverability with cryptographic proof.
The archive carries the protected data, files, configuration and secret material needed for a complete cross-host recovery. A passphrase-derived key seals it; authenticated chunks expose alteration; optional origin signing proves where it came from.
A half-sealed output is removed. A failed open removes the partial destination. The system never silently substitutes an unsealed archive.
Sealed backup job · runningWorker slice 18 / 24
Streaming and authenticatingFull installation recovery set
72%01
Workspace dataSchema + bounded database rows
sealed02
Protected filesUploads and installation-owned assets
streaming03
Configuration + secretsRecovery material stays inside ciphertext
queued04
Manifest + final tagCompleteness gate before restore
waitingKey derivationArgon2idMemory-hard, per-archive salt
Authenticated streamXChaCha20-Poly1305Header-bound metadata + chunk tags
ProvenanceEd25519Optional detached origin signature
.opsiqx
opsiq-full-backup.opsiqxMode 0600 · bounded-memory stream · restore preflight
Verify before import
✓
header authenticated · archive metadata bound
✓chunk stream valid · final tag present
✓origin verified · Ed25519 signature accepted
→restore is still preflight only · import not applied
AUTHENTICATING CHUNKSWRITING FINAL TAGVERIFYING RESTORE INPUT
At a glance
The full security toolkit.
A complete control surface for identity, code, data, APIs, connectors, AI, customer channels and incident response. Built for a serious enterprise review, not a checklist of login features.
Enterprise identity and least privilege
- TOTP, recovery codes and optional organisation-wide 2FA.
- OIDC and SAML SSO with SCIM lifecycle provisioning.
- Password policy, k-anonymous breach screening and account/IP lockouts.
- Step-up confirmation, new-device alerts and device revocation.
2FA policyOIDC + SAMLSCIM eventsStep-up access
Data protection
- Authenticated encryption for stored secrets.
- Installation-bound key material and unique nonces.
- Redacted secret interfaces and live rotation.
- Deployment-specific residency and retention.
Workspace boundary
- Workspace and site-scoped access checks.
- Workspace-locked API keys and connector ownership.
- Audit ownership carried with every relevant record.
Signed I/O
- HMAC-SHA256 over raw webhook bodies.
- Timestamp and nonce replay protection.
- Scoped API keys with IP allowlists and rotation.
Application and browser defence
- IP/CIDR firewall, failed-login lockout and threat scoring.
- CSP report/enforce and CSRF validation.
- MIME-aware upload quarantine and remote-fetch boundaries.
- Outbound-request controls reduce SSRF and unsafe destination risk.
Code and connector supply chain
- Stage, approve, reject, disable and roll back custom code.
- Separate manage and approve permissions with emergency disable.
- Package hashes and signatures; Ed25519 provenance when present.
- Static safety, contract conformance and runtime scope gates.
Messaging and abuse protection
- Shared email, domain and IP block decisions.
- Known-customer guard protects legitimate ticket history.
- Local heuristics first; AI reviews ambiguous new-sender mail.
- Honeypot, rate limits, disposable-email and challenge controls.
AI safety
- Registered action contracts only.
- Human confirmation on risky writes.
- Provider data-handling policy remains visible.
- Registered action result and approver can be logged.
Audit and response
- Tamper-evident audit chain with CSV and JSON export.
- Security event filters by actor, action, IP and risk.
- Integrity verification, checkpoints and lawful-redaction accounting.
- Attack origins, incident records, response notes and alerts.
AI security analyst
- Verdict chips and Explain on suspicious IPs.
- Incident briefs, daily digest and weekly posture check.
- 0-token block policies with opt-in, guardrailed autopilot.
Security posture
Where OpsIQ stands today.
Honest status: what is live, what is aligned, and what is on the roadmap. No borrowed badges, no certification claims we do not hold.
Live controls
Operations & defence
When something's off, you stay in control.
Know who's knocking, release a locked teammate in one click, and watch the platform guard its own health, every move logged.
IP intelligence
Every address classified and risk-scored on sight.
OpsIQ doesn't just count bad logins; it tells you what kind of address is hitting you. Each IP is classified as residential, shared, datacenter or internal, then given a 0–100 threat score from bot and takeover signals on the visitor journey. Datacenter ranges hammering your login form look very different from a customer on home broadband, and your lockout thresholds can treat them differently.
IP classification: residential, shared, datacenter or internal, surfaced on every event.
0–100 threat score: bot and account-takeover signals, anything ≥50 highlighted.
One-click ban. Block every IP on a suspicious session from a single button.
Journey timeline: every failed-login attempt replayed as its own reviewable trail.
Live
Incident response
Stay in control when something's off.
When a teammate gets locked out, you release them in one click, with no waiting for a timer. Sweep active failed-login counters in bulk after an incident, search the full failed-login history to investigate, and bulk-delete stale records once it's resolved. Every release, reset and deletion is itself written to the audit log, so the cleanup is as accountable as the breach.
Manual lockout release. Clear a locked admin or IP instantly, no timer wait.
Active-counter monitoring. See every live failed-login counter at a glance.
Bulk reset & history search: sweep counters, search the full attempt history.
Bulk history deletion. Purge resolved records; the deletion is logged too.
Live
System protection
The platform watches its own health.
Beyond the perimeter, OpsIQ guards its own integrity. A signed license check keeps the install genuine, built-in health diagnostics surface a live snapshot of the platform's vital signs, and front-end JavaScript errors are captured server-side so a broken release shows up in your dashboard instead of silently failing on a customer's screen.
License integrity. Signed validation keeps the install genuine and tamper-evident.
Health diagnostics: a live snapshot of the platform's vital signs, on demand.
JavaScript error capture. Front-end errors logged server-side, not lost on the client.
Secrets outside the web root: config and keys never served by the web tier.
Live
AI security analyst
Not just recorded. Understood.
The opt-in analyst turns identity, abuse and audit signals into a defensible incident narrative, without entering the request path or taking irreversible action.
Guarded intelligence
AI explains the uncertain edge. Policy keeps control.
Deterministic scoring remains the first line of defence. The model is asked only when interpretation helps: an ambiguous IP, a fresh incident or a daily posture brief. Related entities batch into one review, verdicts are cached, and a hard monthly budget lives in AI Config. If that budget is reached, blocking, lockouts and alerts continue under deterministic policy.
Zero AI in the hot path
Verdicts cached 24h
Own budget cap
Every action audited
Live verdict
Explainable
Verdict chips + Explain
Blocked IP and failed-login rows show benign, suspicious or hostile confidence. Explain opens the facts used, the reason, and one-click Block or Release. Cached reviews stay free.
Clustered
Incident briefs
Related events become one story: login waves, URL scans and auto-block bursts. Each incident gets a plain-English timeline, one next move, and ongoing attacks fold into the same case.
Daily
Daily digest
One morning recap compares yesterday with your baseline, lists new blocks and incidents, then highlights the single action worth doing today. Quiet days return all clear at zero tokens.
Hardening
Weekly posture check
A Monday checklist surfaces admins without 2FA, loose lockout thresholds and disabled alerts. Every item includes severity, effort, and the exact fix to approve or assign.
Ask
Ask Security
Ask why an IP was blocked, what changed overnight, or what to harden first. Answers come from live security state; deep server work routes to admin engineering, never guessed.
Opt-in
Policy autopilot
Proposes reversible block rules with Approve or Dismiss cards and live hit counters. Autopilot stays opt-in, time-limited, capped, undoable, and never targets shared/mobile ranges.
It recommends and explains. It can never run wild.
The analyst suggests, clusters and (only with autopilot on) applies reversible blocks. It cannot delete data, change settings, touch the audit ledger or make a permanent ban; each registered analyst action is written to the tamper-evident audit chain.
0AI calls in the request path
24hverdict cache per entity
≤/24widest unattended block
Loggedregistered analyst actions
Full feature list
Everything in Security.
Every capability, grouped. ★ marks a stand-out.
| Feature | What it does |
|---|---|
| Authentication | |
| Two-factor (TOTP) | Per-admin RFC-6238 two-factor for Google Authenticator, 1Password, Authy or any compatible app. |
| Single-use recovery codes | Regenerable backup codes so a lost device never locks you out for good. |
| OIDC single sign-on | Connect an eligible enterprise identity provider and preserve password access where policy permits. |
| SAML 2.0 single sign-on | Support SAML-speaking identity providers with domain policy and certificate configuration. |
| SCIM provisioning | Automatic admin create and deactivate from your IdP; every change logged. |
| Password policy | Set minimum requirements for newly created or changed passwords. |
| Breached-password screening | Optional Have I Been Pwned screening uses k-anonymity: only a short hash prefix leaves the server, never the password. |
| Account lockout | Protect an account when credential stuffing rotates across source IPs. |
| Step-up verification | Require fresh password confirmation before dangerous actions, with a short-lived verification window. |
| New-device alerts & revocation | Email and in-app alerts surface unfamiliar sign-ins so authorised admins can review and revoke devices. |
| reCAPTCHA on login | Optional bot challenge on the sign-in form to slow automated attacks. |
| Hardening | |
| Failed-login lockout ★ | Rolling failure counters trip an automatic IP lockout once the threshold is crossed. |
| IP & CIDR blocking ★ | Block a single address or a whole range by hand; bans propagate across a session. |
| IP classification ★ NEW | Each address tagged residential, shared, datacenter or internal on every event. |
| Threat scoring | 0–100 bot and account-takeover score; anything ≥50 is highlighted. |
| Rate limiting | Sensitive and public request surfaces can be throttled against brute force and abuse. |
| Content Security Policy | Report-only and enforce modes help control scripts, frames, connections and browser-side injection risk. |
| CSRF validation | State-changing browser requests use token and header validation. |
| Upload quarantine | Untrusted files are isolated and checked before they join a trusted workflow. |
| Portal abuse controls | Honeypot, rate limits, disposable-email blocking and reCAPTCHA or Turnstile can protect public support submissions. |
| Code & connector security | |
| Custom-code governance ★ | Custom JavaScript revisions can be staged, separately approved or rejected, disabled and rolled back. |
| Emergency disable | Disable governed custom code without deleting its revision history or losing the rollback path. |
| Package hashes & signatures | Connector archives verify file integrity and package signatures before installation. |
| Ed25519 provenance | Prefer cryptographic proof of package origin when a connector supplies it. |
| Static safety scan | Uploaded archives are inspected and unsafe executable patterns are rejected before files are committed. |
| Contract conformance | Manifest, handlers, settings, documentation and declared capabilities pass a shared registry gate. |
| Runtime policy | Least-privilege scopes, confirmation, dry runs, idempotency contracts and audit records govern connector execution. |
| Messaging & abuse security | |
| Shared block decisions | Email, domain and IP blocks protect the applicable support surfaces from one policy layer. |
| Known-customer guard | Real customer ticket history avoids being screened as an unknown spam sender. |
| AI Spam Detector ★ | Local heuristics handle clear cases first; the model reviews ambiguous new-sender messages only when needed. |
| Advisory or autonomous mode | Choose whether suspicious messages are suggested for review or moved under the configured policy. |
| Restorable spam isolation | Suspected spam stays readable and reviewable so operators can restore a false positive. |
| Provider fail-open policy | If optional model review is unavailable, delivery is not silently discarded. |
| Authorization | |
| Role-based access control | Owner, admin and support roles so each person sees only what their job needs. |
| Per-page permission grants NEW | Grant or revoke individual admin pages per teammate for fine-grained access. |
| Confirmation policies | Per-action gating that forces an explicit confirm step on sensitive operations. |
| Data protection | |
| Workspace-scoped access ★ | Workspace and site identifiers, key scopes, connector ownership and audit ownership travel with protected operations. |
| Authenticated secret storage | Sensitive integration values use authenticated encryption with installation-bound key material and a unique nonce. |
| Secret redaction & rotation | Stored values are masked in interfaces and can be replaced without exposing the saved plaintext. |
| Protected application keys | Installation secrets are kept outside public web paths and are not returned through ordinary API responses. |
| Backup & recovery security | |
Sealed .opsiqx archive ★ | Package a full installation recovery set inside an OpsIQ-specific encrypted container. |
| Argon2id key derivation | A unique salt and memory-hard password hashing derive the per-archive stream key. |
| Authenticated secretstream | XChaCha20-Poly1305 authenticates metadata and every bounded chunk while keeping peak memory controlled. |
| Optional Ed25519 provenance | A detached signature can prove the sealed file originated from the signing installation. |
| Truncation-fatal restore | Wrong passphrase, altered bytes or a missing final tag remove partial output and stop import. |
| Worker-driven backup jobs | Large backups progress in bounded slices and expose status instead of occupying one long web request. |
| API security | |
| Signed webhooks ★ | HMAC-SHA256 over the raw body with timestamp and nonce replay protection, both directions. |
| Scoped API keys | Workspace-locked keys in All, Read-only or Restricted permission modes. |
| IP allowlist on keys | Restrict a key to specific IPs or CIDR ranges so a leaked key is still useless elsewhere. |
| Key rotation & revocation | Rotate or revoke any key instantly; secret keys are never returned again after creation. |
| Per-hour rate limits | Each key carries its own request budget to contain abuse. |
| Audit | |
| Tamper-evident audit chain ★ | Security and registered action records can carry actor, role, IP, time, action and result in a verifiable hash chain. |
| Chain verification & checkpoints | Verify ledger continuity, create integrity checkpoints and account for authorised redactions. |
| CSV / JSON export | Hand auditors the whole trail in a portable format. |
| Filtering | Slice the log by action, actor, date or risk to find exactly what you need. |
| Security events | Sign-ins, 2FA, permission and SCIM changes are all recorded as events. |
| Failed-login journey timeline ★ | Every attempt against an account replayed as its own reviewable journey. |
| Lockout & counter monitoring NEW | See every live failed-login counter and active lockout at a glance. |
| Failed-login history search NEW | Search the full history of login attempts to investigate an incident. |
| Incident response | |
| Manual lockout release NEW | Clear a locked admin or IP in one click without waiting for a timer. |
| Bulk counter reset NEW | Sweep all active failed-login counters clear after an incident. |
| Bulk history deletion NEW | Purge resolved failed-login records in bulk; the deletion itself is logged. |
| Installation self-IP guard ★ | The installation's own IPv4 and IPv6 are excluded from attack classification, scan detection and automatic block waves. |
| System protection | |
| License integrity | Signed validation keeps the install genuine and tamper-evident. |
| Health diagnostics NEW | A live snapshot of the platform's vital signs, on demand. |
| JavaScript error capture NEW | Front-end errors are logged server-side instead of silently failing on a customer's screen. |
| Outbound request guard | Remote calls are constrained to reduce SSRF and unsafe destination risk. |
| Connector security sync | Security block decisions can be synchronised with compatible connected systems. |
| AI safety | |
| Action contracts ★ | The AI can only invoke registered operations with declared scope, roles and parameters. |
| No off-contract actions | Unknown operations are rejected at the brain layer before they reach an endpoint. |
| Human approval on risky writes | Sensitive actions always require an explicit human confirmation. |
| Registered AI actions logged ★ | Action execution, result and approval evidence can be written to the audit trail. |
| Provider policy visibility | Data handling follows the AI provider and deployment selected by the workspace. |
| Compliance & admin | |
| Data residency & retention | Cloud location and retention follow the workspace service configuration; self-hosted data remains in the chosen deployment. |
| Owner-only audit access | The full AI history audit log is restricted to the workspace owner. |
| Privacy operations | DPA support, DSAR export/delete tooling, consent records and configurable retention workflows. |
| Admin user management NEW | Invite, role, deactivate and audit every admin from one console. |
| Department management NEW | Organise teams into departments with their own access and routing. |
For your security team
Common questions they will ask.
No. AI calls hit the model provider you choose (Anthropic, OpenAI, Gemini, Grok or self-hosted) with the live conversation context only. Provider standard data handling applies; most don't train on API traffic by default.
Cloud location and retention depend on the service configuration agreed for your workspace. A self-hosted deployment keeps its data wherever you install OpsIQ.
Sensitive values use authenticated encryption with installation-bound key material and a unique nonce. Saved secrets are redacted in the interface and can be rotated without exposing the stored plaintext.
Yes. Account → Privacy provides self-service export and deletion controls, and authorised operators can use the erase workflow. The deletion itself remains accountable through the audit chain and lawful-redaction register.
Export, deletion and backup-rolloff timing follow the service configuration or customer contract. Ask sales for the exact policy that applies to the deployment you are evaluating.
Use the security contact published in
/.well-known/security.txt, or open the contact page and choose the security route. Current security evidence can be discussed during a vendor review.Not yet. OpsIQ includes authenticated secret storage, RBAC, tamper-evident audit chains, signed I/O and workspace-scoped controls today. SOC 2 Type II and ISO 27001 remain roadmap items; we do not claim certifications we do not hold.
Eligible deployments can connect OIDC or SAML single sign-on and use SCIM lifecycle provisioning. Identity policy, domain rules and provisioning events remain visible to authorised operators and are recorded for audit. Self-hosted installs configure their own IdP.
Custom JavaScript revisions can be staged, separately approved or rejected, disabled and rolled back. Connector archives pass integrity, provenance, static-safety and contract checks before runtime scopes, confirmations, dry runs and audit controls apply.
A sealed
.opsiqx archive uses Argon2id key derivation and XChaCha20-Poly1305 authenticated streaming. Optional Ed25519 provenance verifies origin, and an altered, wrongly unlocked or truncated archive is rejected before import applies anything. Backup jobs run in bounded worker slices so a large installation does not depend on one long web request.The AI can only invoke registered action contracts, each with a declared scope, allowed roles and parameters. Anything off-contract is rejected at the brain layer before it reaches an endpoint, and risky writes require an explicit human confirmation. Every action it does take is recorded in the audit log with the human who approved it.