Governance overview
Some audit data is for the people who answer for the workspace: past approval decisions, the workspace-level activity log that cuts across every feature, and the review of logins that reached servers without Alpacon. The Governance group collects those.
Each page in the group appears only to the roles that can open it. Approvals and the activity log are for administrators. External access is for the reviewer, auditor, security_admin and admin roles. A member who holds none of these doesn’t see the group.
How to get here
Open the sidebar and expand Audit → Governance.
Pages in this group
- Approvals — past approval decisions on work sessions, sudo grants, certificate operations, and other gated requests. Shows the reviewer, the outcome, and the justification on record.
- Activity log — workspace-level events that don’t belong to the Events group: sign-ins, IAM changes, setting updates, resource access.
- External access — logins that reached a server without Alpacon (SSH, the console,
su), the findings reviewers decide, and the period’s coverage and evidence.
How this differs from Events
Events answers “what did people do on my servers?” Governance answers “who decided what at the workspace level?”
The two views overlap occasionally. For example, an approval-grant sudo authorization shows up in both — as a Sudo row (the authorization itself) and as an Approvals row (the decision that allowed it).
The two views answer different questions:
- Events answers “what command actually ran?”
- Governance answers “who said yes to allowing it?”
For the operational approval queue (requests still waiting for a decision), use Pending approvals under the Execution group in the sidebar. This Governance section is for reviewing decisions that have already been made.