Audit log
Who changed the policy, rotated a token, added a connection or moved a plan, every team-level action recorded with its actor, plus sign-ins, refused changes and every token used from a new address. Browsable from the dashboard, included in the export.
Every team-level action is recorded with who did it and when: policy edits, token creation and revocation, connections added, changed or removed, members invited, roles changed, retention changed, plan changes, including the ones Stripe makes, recorded with Stripe as the actor. The log is browsable from the dashboard and included in the export.
Access is in it too: every sign-in and sign-out, every failed sign-in, every change a viewer or billing role was refused, and every team token the first time it is used and each time it is used from a new address, so a leaked CI secret used from somewhere unexpected leaves a trace. A test in the codebase fails on any new route that changes state without writing to the log.
It exists so “who turned that rule off” has an answer, and so a compliance reviewer can see the controls were used, not just that they exist.
The CLI is open source and needs no account: npx bolvrk check migration.sql