Document continuous audit log export

[yummybomb]

summary

• distinguish audit-log search, one-time downloads, and continuous S3 export
• document destination setup, IAM trust and permissions, KMS configuration, object layout, delivery semantics, health fields, and troubleshooting
• add the kernel audit-logs export command reference with all subcommands, aliases, flags, JSON output, and activation guidance

why

Users need a complete path from creating a paused destination through testing and activation, along with clear expectations for delivery guarantees and lifecycle behavior.

The CLI reference tracks the current command implementation and does not claim availability in a specific released CLI version. Users should install a release that includes the command group.

validation

• mintlify dev --no-open loaded both updated pages
• git diff --check passed

---

Note

Low Risk
Documentation-only changes with no runtime, auth, or data-path code modifications.

Overview
Audit log docs now separate three paths: search, bounded downloads (renamed from “export”), and continuous S3 export (Enterprise). Plan tiers are called out for search/download vs continuous export.

The main guide adds an end-to-end continuous S3 export section: create a paused destination, IAM trust (kernel_role_arn, external_id), S3/KMS policies, test then activate via SDK examples, plus object key layout, at-least-once delivery (no backfill, pause/resume behavior), health fields, and troubleshooting.

The CLI reference documents kernel audit-logs export (and aliases) with subcommands, flags, JSON output, activation steps, and a note that the command group depends on the installed CLI release.

^{Reviewed by Cursor Bugbot for commit 262cc2b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Kernel	🟢 Ready	View Preview	Aug 10, 2026, 5:00 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Aug 10, 2026 10:02pm

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now afb3d36. Re-checked the full diff and the incremental change.

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+417 / −8)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since prior approval: terminology-only edits in info/audit-logs.mdx ("one-time export" → "download"); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/terminology; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now e33edb6. Re-checked the full diff and the incremental change since the last assessment (afb3d36 → e33edb6).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+418 / −9)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: heading/anchor rename in info/audit-logs.mdx (Export audit logs → Download audit logs and matching TOC link); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/terminology; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 10774a1. Re-checked the full diff and the incremental change since the last assessment (e33edb6 → 10774a1).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+422 / −9)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: plan-availability notes (Start-Up/Enterprise for search/download; Enterprise for continuous S3 export) in both MDX files; no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/plan notes; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 9775538. Re-checked the full diff and the incremental change since the last assessment (10774a1 → 9775538).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+423 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: one wording tweak in info/audit-logs.mdx (Export chunks → Downloaded chunks); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/terminology; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 657da20. Re-checked the full diff and the incremental change since the last assessment (9775538 → 657da20).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+463 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: continuous-export setup section rewritten around SDK/HTTP examples (create → IAM → test/activate) in info/audit-logs.mdx; no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/examples; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 411ccda. Re-checked the full diff and the incremental change since the last assessment (657da20 → 411ccda).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+452 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: shortened destination-setup intro in info/audit-logs.mdx (removed HTTP endpoint table / create-body detail; kept SDK/CLI/API pointer); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content trim; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 5a105b5. Re-checked the full diff and the incremental change since the last assessment (411ccda → 5a105b5).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+448 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: removed --offset flag docs and related pagination note from reference/cli/audit-logs.mdx (export list); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/CLI flag docs trim; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now e010a23. Re-checked the full diff and the incremental change since the last assessment (5a105b5 → e010a23).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+448 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: example destination IDs updated in reference/cli/audit-logs.mdx (dest_01h… → y2kkbpcz1lg0h3q6yr8x4m7d); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Example ID string swap; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 2700ca3. Re-checked the full diff and the incremental change since the last assessment (e010a23 → 2700ca3).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+448 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: removed event_id deduplication guidance from delivery-semantics copy in both files (kept at-least-once wording); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content trim; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation

Triggered on ready_for_review. This automation previously approved commit 3d481fd; HEAD remains 2700ca3. Re-checked the full base…head diff independently.

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+448 / −10)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference (create/list/get/update/pause/resume/delete/test)
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content/docs expansion; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk is Very Low. An approval from this automation is already in place and risk has not increased, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low

Verdict: Keep existing approval (no re-approve)

Re-evaluation after synchronize

This automation previously approved commit 3d481fd. HEAD is now 262cc2b. Re-checked the full base…head diff and the incremental change since the last assessment (2700ca3 → 262cc2b).

Evidence (from diff only)

• 2 files changed, both Mintlify docs: info/audit-logs.mdx, reference/cli/audit-logs.mdx (+427 / −14)
• Pure documentation: continuous S3 export guidance plus CLI audit-logs export reference
• Incremental change since last review: content trim/tighten in info/audit-logs.mdx (net −25 lines); no new files, no new codepaths
• No application code, infra, auth, billing, schema, CI config, CODEOWNERS, or model-instruction file changes
• No production logic or shared runtime surface modified
• No CODEOWNERS file present for this repo path

Risk factors

Factor	Assessment
Codepaths modified	Docs-only MDX
Blast radius	None (rendered docs)
Complexity	Content trim; no behavioral coupling
Infrastructure impact	None
Operational / security risk	None from this diff

Decision

Risk remains Very Low. It has not increased since the prior approval, so approval is left in place and not re-submitted.

  

_{Sent by Cursor Automation: Assign PR reviewers}