Expanded audit event categories
Environment audit now catalogs user lifecycle, email, account, RBAC, MFA, and authentication events without extra mapping work.
From the changelog: Expanded audit event categories
Authdog Team
Audit logs are only useful if the events you care about land in a category you can filter. Authdog already recorded sign-ins, impersonation, elevated access, and MCP tool calls. The default catalog now also covers everyday user and account lifecycle work that previously sat outside those buckets.
This is the longer note behind the September 1 changelog entry.
What changed
The shared event catalog in the platform now maps more event types to named categories, and the default environment subscription list includes those categories out of the box.
New environment categories include:
user_lifecycleemail_verificationemail_managementaccount_managementprofile_managementrbac_managementmfa_managementauthentication
Organization audit also gained API key management, so key create and rotate events sit next to the rest of org administration instead of a generic dump.
Existing categories stay: authn, team_management, administration, security, mcp_runtime, plus environment, project, MCP, and platform management.
How categories are applied
Each emitted event carries an eventType. The catalog maps that type to a category (EVENT_TYPE_TO_CATEGORY). Ingest and query paths use the map so a NEW_USER event is authn, an impersonation grant is administration, and an MCP tool denial is mcp_runtime.
Defaults are the unique set of catalog categories plus the lifecycle list above. Environments that already customized their category list are not silently rewritten; new defaults apply to environments that still use the platform catalog.
Why it matters
Console and SIEM filters only work if the category exists before you need it. User invite, email change, MFA enrollment, and role edits are the events operators look for after an incident. Shipping them as first-class categories means you can subscribe, export, and alert without waiting for a custom mapping.
Trust boundaries
Audit records what the control plane already did. A category does not grant access; it labels an event. Keep organization and environment streams separate. MCP runtime events (MCP_TOOL_INVOKED, MCP_TOOL_DENIED, and related types) stay distinct from console-plane MCP server CRUD.
Do not treat a missing category as proof the action never happened. Older events keep the category they were written with.
Try it
Open Audit in the console and filter by the new categories. Export or SIEM setup is in the audit logs guide. The original release note is in the changelog.