Audit evidence

An activity label is not enough.

Garden's current platform records attributed application, release, connection, workbench, data-access, and operating actions. Each event identifies who acted, what happened, what object was affected, when it happened, and a bounded payload appropriate to that event.

Scope: Garden control-plane actionsLocation: customer projectUpdated: August 4, 2026

The current event shape

Field	Purpose	Boundary
id	Stable event identifier	Identifies the event; it is not a cryptographic proof.
actor	The human, token identity, worker, or system component attributed to the action	Attribution depends on the identity boundary that invoked Garden.
action	A specific event name such as `release_published` or `connection_bound`	It records Garden's action vocabulary, not every business event inside an app.
target_type and target_id	The app, release, connection, workbench, or other object affected	The identifier may require related inventory data to be meaningful to a reviewer.
payload	Event-specific context such as app identity, release URL, table name, or change summary	Payloads are bounded and should not contain credentials or unnecessary record contents.
created_at	The recorded event time	Time quality depends on the installed platform and its clock.

Illustrative redacted event

This example uses the current public event fields and a real Garden action name. Identifiers and URLs are deliberately fictional; it is not a customer record or a claim that a particular release occurred.

{
  "id": "aud_example",
  "actor": "owner@example.com",
  "action": "release_published",
  "target_type": "release",
  "target_id": "rel_example",
  "payload": {
    "app_id": "app_example",
    "revision": "service-revision-example",
    "url": "https://app.example.invalid",
    "draft_url": "https://draft.example.invalid",
    "superseded_release_ids": ["rel_previous"]
  },
  "created_at": "2026-08-04T19:00:00Z"
}

Event families in the pilot

Application custody

Creation, tracking, import, archive, unarchive, and deletion establish whether an app is merely known, managed, stopped, restored, or removed.

Source and releases

Source receipt, release request, runtime snapshot, worker claim, draft ready, publish, retry, rollback request, failure, cancellation, and archive events explain the release path.

Configuration and access

Configuration and Google access-policy changes are recorded and, when a live app is affected, create a release-shaped action rather than a silent runtime mutation.

Connections

Create, set credential, check, bind, unbind, handoff, rotate, and delete events record the lifecycle of company-owned connections without logging the secret value.

Application data operations

Supported data viewing and export record the resource and table involved. Export events do not store exported cell contents in the audit payload.

Workbench and platform work

Provision, suspend, resume, reset, failure, and platform worker events distinguish owner intent from asynchronous system execution.

How to use the record

Start with the app and release inventory to establish which revision coworkers used during the period.
Find the owner or system identity that requested the material change.
Follow request, worker, success, or failure events instead of interpreting one event in isolation.
Compare the event payload with source, release, access, connection, and data-recovery evidence outside the audit stream.
Record unresolved gaps rather than treating event presence as proof that the resulting application behavior was correct.

What the current audit trail does not prove

Explicit limits

The current API does not claim cryptographic tamper evidence, independent anchoring, or a verification endpoint.
This page does not promise a configurable retention period, legal hold, export format, or third-party archive. Those requirements must be confirmed for the installation.
Garden events cover Garden-managed actions. They do not replace business-level audit events inside each internal application.
Connections call external services directly. Garden does not record or authorize every downstream API request.
An attributed publish event proves that Garden recorded the action; it does not prove the application is secure, compliant, or correct.

Customer-cloud architecture and ownership Production lifecycle and rollback Fleet visibility and governance About Garden and design-partner scope

This page documents the current pilot event model and its limitations. It is not a compliance certification or legal record-retention commitment. Send product questions or corrections to hello@gardenai.ai.