---
title: Audit logs
url: https://www.tines.com/stories/docs/admin/audit-logs/
updated: 2026-09-02T12:46:02+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Admin](https://www.tines.com/llm/stories/docs/admin.md)*

# Audit logs

*[View on tines.com](https://www.tines.com/stories/docs/admin/audit-logs/)*

> **NOTE:** Not seeing this feature? Talk to your tenant admin or [reach out to the Tines team](https://www.tines.com/contact-support/) to learn more.

We automatically capture an audit log any time a user changes any piece of data in your Tines Stories tenant.

These audit logs are available to tenant admins and users with the `AUDIT_LOG_READ` permission via the UI and API. Information about the operations logged can be found in our [API docs.](https://www.tines.com/api/audit-logs/)

The retention period for audit logs in your Tines Stories tenant is two years.

## Enhanced AI audit logs



Tenant admins can enable enhanced AI audit logs from the AI settings in the settings center. When enabled, we log detailed audit entries for AI operations across Workbench, AI Agent actions, and other AI features.



Each AI model invocation is logged as an `AiModelRun` operation, recording the model used, token counts, and the full response text, including the model's reasoning where available. Tool uses by Workbench and AI Agent actions are logged as separate operations, recording the tool name, inputs, outputs, and execution status.



Enhanced AI audit logs are available via the UI and API, and are included in scheduled exports, alongside all other audit logs.

## Exporting audit logs

We currently support scheduled exports of audit logs to[ Amazon S3](https://aws.amazon.com/s3/) buckets, which runs every 15 minutes. Only tenant admins can configure this setting.

[Video](https://stream.mux.com/fdx00fNU7R8eQ4vYAJsZ4wzXRIvTzLfUu/high.mp4)

#### **Credentials for Amazon S3**

To securely invoke Amazon S3 APIs, Tines Stories supports AWS authentication using [assumed roles](https://www.tines.com/docs/credentials/aws/).

##### **Required IAM permissions**

To allow exports to S3 from Tines Stories, the IAM role must include the following permission:

```json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3::[bucket-name]/*"
        }
    ]
}
```

## Retention periods

As a default, Tines will retain audit logs for up to two years. From the settings cog, tenant admins can set the retention period for audit logs as low as 30 days.