Audit logs
We automatically capture an audit log any time a user changes any piece of data in your Tines Stories tenant.
These audit logs are available to tenant admins and users with the AUDIT_LOG_READ permission via the UI and API. Information about the operations logged can be found in our API docs.
The retention period for audit logs in your Tines Stories tenant is two years.
Enhanced AI audit logs
Tenant admins can enable enhanced AI audit logs from the AI settings in the settings center. When enabled, we log detailed audit entries for AI operations across Workbench, AI Agent actions, and other AI features.
Each AI model invocation is logged as an `AiModelRun` operation, recording the model used, token counts, and the full response text, including the model's reasoning where available. Tool uses by Workbench and AI Agent actions are logged as separate operations, recording the tool name, inputs, outputs, and execution status.
Enhanced AI audit logs are available via the UI and API, and are included in scheduled exports, alongside all other audit logs.
Exporting audit logs
We currently support scheduled exports of audit logs to Amazon S3↗ buckets, which runs every 15 minutes. Only tenant admins can configure this setting.
Credentials for Amazon S3
To securely invoke Amazon S3 APIs, Tines Stories supports AWS authentication using assumed roles.
Required IAM permissions
To allow exports to S3 from Tines Stories, the IAM role must include the following permission:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"s3:PutObject"
],
"Resource": "arn:aws:s3::[bucket-name]/*"
}
]
}Retention periods
As a default, Tines will retain audit logs for up to two years. From the settings cog, tenant admins can set the retention period for audit logs as low as 30 days.