Audit trails

Scheduling generates disputes, and almost all of them are really questions about history. Who moved that shift. Was my request approved or did it expire. Was I on call that weekend.

Without a record, these are resolved by whoever remembers more confidently.

What is written

An audit entry is written for every change to:

A shift assignment — created, reassigned, moved, locked, cancelled, or swapped.
A request's status — submitted, approved, denied, withdrawn, expired.
A user record — role, status, site membership, staff category.

Each entry carries the acting user, the timestamp, and what the value was before.

Those three categories are not a logging preference; they are the set of things people argue about. Writing them is a requirement on every mutation in the codebase rather than something a deployment can turn down to save space.

Acting as someone else is recorded as that

A platform administrator can act as another user in order to reproduce a problem they are reporting. Where that happens, the audit entry records both identities: the user whose account the action appears under, and the administrator who was actually driving.

A log that showed only the first would be worse than no log, because it would attribute an action to someone who did not take it — and it is exactly the entry somebody would later rely on.

That access is time-boxed rather than indefinite, and the session has its own identifier so every action taken during it can be found together.

What it is for, in practice

Disputes. "I never got that request" has an answer.

Credentialing and compliance. Reconstructing who covered a service on a given date is a question that arrives months later, from outside the department.

Understanding a schedule that went wrong. A period that ended up badly distributed usually got there through a sequence of individually reasonable changes. The sequence is the explanation.

Common questions

What is recorded?

Changes to shift assignments, to the status of a request, and to user records — with the acting user, the timestamp, and the previous value. Those three categories are the ones that answer disputes, so they are written on every mutation rather than being an optional log level.

Can an administrator edit the audit log?

There is no interface for editing or deleting audit entries. They are written as part of the change they describe.

Schedule publishing — the states a period moves through.
Security — what is stored, and what is not.