Governance and security

Audit, retention and deletion

Audit trails, security events, retention policies with review and purge, and a dependency-aware deletion queue.

Audit

Audit log — every create, update, delete, publish and import, with who, when and which fields changed (usertasks audit-log list, needs settings.view).
Permission audit — role grants and removals, including those made by workflows.
Security events — OAuth consent and tokens, API key lifecycle and failures, code replay and refresh reuse.
Run history and integration call logs — every step and outbound call.

All of these feed the event stream as audit.*, security.* and system.* events, so you can keep them in your own SIEM for as long as you need.

Retention policies

A retention policy says how long something is kept and what happens then:

`policy_mode`	Effect
`review`	After a duration, a review is due (fires Policy Review triggers)
`review_on_exact_date`	Review on a date
`purge_on`	Purge after a duration
`purge_on_exact_date`	Purge on a date
`keep_forever`	Never purged

Durations are days, months or years. Assign policies to data tables, individual rows and roles (roles support review modes only):

bash

usertasks retention create --set name="Invoices 7 years" --set policy_mode=purge_on --set duration_value:=7 --set duration_unit=years
usertasks retention assign --set target_type=data_table --set target_id=<table-id> --set retention_policy_id=<policy-id>

The retention job runs daily (03:00 UTC); executions fire Policy Executed triggers and system.retention.* events.

Deletion queue

Deleting workflows, reports, data tables, integrations, decision tables, agents, custom steps, retention policies or rows goes through a queue. Dependencies are checked first (a workflow that uses an agent is deactivated, for example), the deletion runs in the background, and system.deletion.completed / failed events report the result.