An audit trail is a chronological, tamper-evident log of every action taken on a system, document, or workspace. For document workflows, this includes views, downloads, edits, signatures, shares, permission changes, and revocations.
Good audit trails capture: timestamp, actor (user or system), action type, target (document, page, field), source IP and device, and any data that changed. The log should be immutable (append-only, hash-chained, or written to write-once storage) so it can't be retroactively rewritten.
Enterprise customers typically require the audit trail to be exportable as CSV for compliance reviews, or streamed in real time to a SIEM (Splunk, Datadog, Elastic) for security monitoring.