Infrastructure audit logs
Keep the context behind sensitive developer operations.
Shortspan records security-relevant activity across the same workspace that holds projects, access requests, secrets, infrastructure, tokens, and runbooks. Review starts with a consistent actor and resource model instead of separate logs for every handoff process.
Why teams change
You cannot review access that was never recorded.
When credentials are delivered through chat or copied from a document, the source system may show a login but not why the person received access, who approved it, or which internal project it served. That gap slows incident response and makes periodic reviews guesswork.
Shortspan attaches sensitive actions to the authenticated user or scoped token, the workspace and project context, and the affected resource. Access requests and runbook executions retain their own lifecycle context, while credential values are deliberately excluded from the audit payload.
What Shortspan adds
Control around the workflow, not another workflow beside it.
Actor and resource attribution
Connect an event to the person or token that initiated it and the project resource affected by the action.
Decision context
Preserve request reasons, approvals, denials, and execution state where the workflow includes a decision.
Secret-safe event design
Record metadata required for review without turning the audit system into another store of plaintext credential material.
The workflow
From registered resource to accountable use.
- 01
Perform work through the broker
Use the Shortspan console, CLI, or scoped API rather than an informal credential handoff.
- 02
Capture the security event
The platform records the actor, action, target context, and time appropriate to the operation.
- 03
Review by project
Authorized administrators inspect the activity stream and resource histories during access review or investigation.
Operational outcomes
Make the secure path the understandable path.
- Faster answers to who accessed which resource and when
- Request and approval context near the resulting access
- Human and automation activity separated by identity
- Audit metadata without logged secret plaintext
Common questions
Know where the boundary is.
- Are secret values written to the audit log?
- No. Credential material must not be logged. Audit events describe the action and resource context without storing the sensitive value itself.
- Can automation be distinguished from a person?
- Yes. Automation uses its own scoped API token, so its activity can be attributed to that token rather than borrowing a human session.
- Does an audit log prove what happened inside every target system?
- No. It proves the workflow and actions observed by Shortspan. Target-system logs remain important for database queries, shell commands, cloud API operations, and other activity that occurs after access is brokered.
Read the implementation details
Documentation for this workflow
Related solutions
Connect the next part of the workflow
Start with one project and one access problem.
Create a workspace free, or tell us what your team needs to broker, approve, and review.