Best GEO Software
All posts
By Best GEO Software Teamaudit logpermissionsgovernanceapi keysbuyer guidesecurity

Audit logs and permissions in AI visibility platforms: what to look for

When agents, API keys, and teammates all change settings, you need to know who did what. A buyer checklist for audit logs, roles, and API key controls.

An AI visibility platform used to be a read-only window: you looked at charts and left. That is no longer how teams use them. Today the same workspace holds prompts that drive cost, content that gets published, integrations that touch your CMS, API keys that pull data into other systems, and chat agents that can change settings on request.

When something changes, the first question is always the same. Who did that? If your platform cannot answer it, you will find out the hard way, usually when a monitor is paused, a prompt list is gone, or a key is leaked.

This guide is a buyer checklist for audit logs and permissions in this category.

Why governance matters more now

Three things changed the risk profile.

  • More ways to make a change. Changes come from the dashboard, the API, MCP clients that other tools connect through, and chat agents. Each is a separate path, and a log that covers only one leaves blind spots.
  • Changes cost money. Prompts, models, and run frequency affect how fast a usage allowance is spent. A single setting can double your consumption.
  • Agents act on instructions. An agent that edits a dashboard or queues content is acting on someone's behalf. You want a record of which user and which route.

None of this requires paranoia. It requires the same hygiene you apply to any system with several editors.

The checklist

Ask each vendor these questions. Write down the answers, because sales calls blur.

Audit log

  • Does it record every change, with who or what made it and when?
  • Does it cover all routes: dashboard, API, MCP, and agent chat?
  • Can you filter by person, source, and outcome, and search by action?
  • Who can see it? Owners only, or any admin?
  • Which plan includes it?

Roles

  • What roles exist? Owner, editor, and viewer is the minimum.
  • Can a viewer see sensitive things like API key secrets? They should not.
  • Can you restrict access by project, or only by organization?

API keys

  • Can keys be scoped to a project, an organization, or read-only?
  • Can you revoke one without disturbing the others?
  • Who can see the key secret after creation?

Sign-in

  • Is single sign-on available, and on which plan?
  • How are sign-in codes handled, and what happens when a user is deactivated?

Recovery

  • Can you restore a deleted project?

How the vendors in our directory compare

Our catalog is thin here, so we only report what the entries say.

  • AthenaHQ lists an audit log, SSO, and multi-region support on its custom Enterprise tier. The catalog puts Enterprise at a high price point, so governance there is a budget conversation.
  • Scrunch AI lists SSO and API access on Enterprise, and the entry does not mention an audit log.
  • Profound lists SSO and SOC 2 on Enterprise, and agents run on credits. An audit log is not described in our entry.
  • Other tools: the catalog entries do not describe audit logging, so treat it as unknown and ask.

A pattern worth noting: in several of these products, governance features sit behind enterprise contracts. That matters for mid-sized teams that run agents and APIs but are not buying enterprise.

Where Promptwatch fits

Promptwatch is the platform we would check first against this list, because it publishes a clear answer to most items. From the September 30, 2026 changelog, the organization settings include an Audit log that lists every change made in your organization, who or what made it, and when. It covers the dashboard, the API, MCP clients, and Agent Chat. You can filter by person, source, or outcome, or search by action.

The plan tier is stated: the audit log is available to organization owners on Business plans and higher. In fact-sheet terms, that means Business ($579/mo), Agency Scale ($799/mo), and Enterprise. Essential and Professional teams do not get it, which is the main tradeoff to weigh.

Other controls support the log:

  • Roles. Owner, editor, and viewer.
  • Scoped API keys. Keys can be scoped to a project, an organization, or read-only.
  • Viewer protections. As of the November 2, 2026 changelog, project viewers no longer see API key secrets or the API keys page.
  • Tighter sign-in. The same release made sign-in codes stricter: only the latest code works, and deactivated users cannot request one.
  • SSO on Enterprise.
  • Restore deleted projects.

Because Promptwatch also has Agent Chat and a hosted MCP server that can read and write, the fact that the log covers those routes is the important part. A log that only recorded dashboard clicks would miss the way many changes now happen.

Keep your expectations right. An audit log tells you what happened. It does not prevent a bad change, so it works best alongside sensible roles and scoped keys. And it is visible to owners only, so decide who your owners are.

A governance setup for a small team

  1. Name two owners, not one and not five.
  2. Give most people the editor or viewer role. Grant ownership only where needed.
  3. Create scoped keys per use. One read-only key for your BI tool, a separate one for automation. Never share a key between systems.
  4. Review the log monthly. Filter by source API and MCP and read what changed.
  5. Remove access when people leave, and revoke their keys.
  6. Write down who can ask an agent to change settings.

For related reading on how agents fit into a team's routine, see our guide to turning GEO data into a weekly to-do list and our notes on agency stacks with MCP, Looker, Slack, and white label.

The takeaway: before you sign, ask who can change what, through which route, and where you can read the record. If the answer is vague, you have learned something about the product.

Related articles