The activity feed recorded what happened to your *data*: uploads, job runs, restores, new buckets. What it didn't record was who changed *access* to it — and that's the half an admin actually goes looking for.

"Who gave them access to that bucket?" now has an answer. These are recorded from today:

• •People — invitations sent and revoked, members removed, roles changed.
• •Groups — created, renamed, membership changed, deleted. Deleting a group also revokes every bucket grant that pointed at it, and the entry says so, because that's usually the missing link when someone loses access unexpectedly.
• •Permissions — every change to who can reach a bucket or a folder, including whether it was opened to the workspace or restricted.
• •API keys — created and revoked, with the key's name, its permission level, and its short prefix so you can tie an entry to a specific key. The key itself is never recorded.
• •Servers and credentials — added, updated, removed. A server entry names *what* changed — a rotated key and a changed hostname have very different consequences when you're reading back through a week of history.
• •Indexing — when a bucket index was started, and by whom.
• •Deletions — removing a bucket or a server drive. The entry states plainly that the bucket itself was untouched; we removed our record of it, nothing more.

Every one of these appears in the activity feed, in team analytics, and in the Business audit export — the CSV carries timestamp, actor and action, so it drops straight into a review or a compliance pack.

Access events are grouped and coloured apart from routine data movement, so scanning a busy feed for the moment something changed hands doesn't mean reading every row.