# Log permissions

:::callout{theme="danger"}
Service and trace logs can contain sensitive content from any data source a workflow reaches, including language model prompts and completions, object property values, and user-supplied inputs. The platform does not propagate markings from the source executor's resource or from any data the execution accessed; only the markings an administrator explicitly applies when enabling log access are enforced on viewers. Enabling log access therefore carries a security risk and should be reviewed against the maximum sensitivity of data the workflow may touch.
:::

## Required roles

The following table lists the access requirements for various operations in Ontology and AIP observability.

| Capability | Required access |
| --- | --- |
| View [metrics](../metrics/index.md) | `View` permission on the resource¹ |
| View [run history](../run-history/index.md) | `Edit` permission on the resource¹ |
| View [trace](../trace-view/index.md) and [service logs](../service-logs-and-debugging/index.md)² | `Edit` permission on the resource¹ + Log access enabled³ + Access to all markings |
| [Search logs](../log-search/index.md)² | `Edit` permission on the resource¹ + Log access enabled³ + Access to all markings |
| [View organization-wide project log access settings in Control Panel](../../administration/configure-logging/index.md#configure-log-access-from-control-panel) | By default, `Organization administrator` role |
| [Configure project-level log access](../../administration/configure-logging/index.md#configure-log-access-from-control-panel) | By default, `Edit` permission on the project + either the `Information security officer` or `Enrollment administrator` role |
| [Configure resource-level log access](../../administration/configure-logging/index.md#configure-log-access-from-workflow-lineage) | By default, `Edit` permission on the resource + either the `Information security officer` or `Enrollment administrator` role |
| [Delete logs](../../administration/configure-logging/index.md#delete-log-history) | `Information security officer` or `Enrollment administrator` role |

To configure project-level log access through Control Panel, you also need the organization-wide viewing access listed above.

¹A Foundry operation backs each capability: `foundry-telemetry-service:read-metrics` (granted by the `Viewer` role) for metrics, and `foundry-telemetry-service:view-execution-history` (granted by the `Editor` role) for run history and logs. You can grant these operations through a different role using [custom roles](../../platform-security-management/manage-roles/index.md).

²Users always have access to logs for their own executions from the past 24 hours with just the `foundry-telemetry-service:view-execution-history` operation, independent of log access settings. This exception does not apply on [CBAC stacks](../../security/classification-based-access-controls/index.md), where log access must be enabled to see logs for one's own executions.

³Log access enablement: An administrator must enable log access either on the source executor resource directly (as a resource override) or on the source executor's project (and attributed project if the resource has been moved). See [log access requirements](#log-access-requirements) below for full details, and [Configure logging](../../administration/configure-logging/index.md#in-platform-log-access-for-ontology-and-aip-workflows) for how to enable it.

## Log access requirements

To view the run history for a resource, you must have **edit** permission on the resource.

To view the trace and service logs for an execution you did not invoke, you must satisfy all three requirements below. The **log access overview** dialog, described in [Review log access requirements](#review-log-access-requirements) below, shows each requirement and whether you currently meet it.

* **Role:** You must have **Edit** permission on the source executor. The source executor is the first executable resource in the call chain and can be a function, action, automation, AIP logic, AIP agent, or model live deployment.
* **Log access policy:** Log access must be enabled for the source executor, either on its **project** (and its **attributed project** — the project the resource first emitted telemetry under — if the resource has been moved) or through a **resource-level override**. An `Information security officer` or `Enrollment administrator` enables this. See [Configure logging](../../administration/configure-logging/index.md#in-platform-log-access-for-ontology-and-aip-workflows) for how to enable log access.
* **Markings:** You must hold every marking applied to the logs. See [Markings on log content](#markings-on-log-content) below.

Actions are a special case. An action managed by [legacy Ontology permissions](../../object-permissioning/ontology-permissions-legacy/index.md) cannot yet be managed at the project level, so enabling log access for it requires a **resource-level override** rather than the project setting, until the action is [migrated to project-based permissions](../../ontology-manager/migrate-to-project-based-permissions/index.md). See [Configure logging](../../administration/configure-logging/index.md#configure-resource-overrides-for-legacy-ontology-permissions) for details.

## Source executor log access status

The **Run history** and **Log search** panels in Workflow Lineage display a status tag for the source executor's log access. The tag reflects your current level of access:

* **Full log access:** Log access is enabled on the project or through a resource-level override, and you hold the required markings. Logs are visible for all executions originating from the resource.
* **User ID secured log access:** Based on your role, you have access to logs from your own executions in the past 24 hours. This applies even when log access is not otherwise enabled (except on CBAC stacks).
* **No log access:** Log access is not enabled and you have no other path to the logs.

When log access is enabled for the project and marking permissions are satisfied, **Source executor log access** will show as enabled. Logs will be visible for all executions originating from the enabled project.

![Source executor log access status tag showing full log access enabled on the project.](../../../assets/d130ee2a2c3ed2f69c553511ef0c6254311611cf06d69c3a5151fe456ebe8022.webp)

Otherwise, only your own executions from the past 24 hours show logs (except on [CBAC stacks](../../security/classification-based-access-controls/index.md)).

![Source executor log access status tag showing user ID secured access for the past 24 hours.](../../../assets/63e60605c1dca1a8f382702582d82477ca00812dcad66c9f87a574988ace2c5b.webp)

:::callout{theme="warning"}
On [CBAC stacks](../../security/classification-based-access-controls/index.md), this 24-hour access to your own executions' logs is disabled. Log access must be enabled on the source executor's project before users can view trace and service logs or search logs, even for their own executions.
:::

## Open the log access overview

To check what you need to read logs, open the **Log access overview** dialog from either of these places:

* From the Workflow Lineage graph, select the resource's node and choose **View log access**.
* From the **Run history** or **Log search** panel, select **View log access** in the top right.

![Workflow Lineage graph node menu showing the View log access option.](../../../assets/31ced88a96312bc8262fb066d622b2afcbd78d8bbab866c3aefc8beaa3e0f76d.webp)

Viewing the overview requires at least the `Viewer` role on both the resource and its project.

If you have the `Information security officer` or `Enrollment administrator` role and can manage log access for the resource, the **Run history** and **Log search** panels show **Edit permissions** in place of **View log access**. That menu adds **Configure log access** and **Delete log history**, both covered in [Configure logging](../../administration/configure-logging/index.md#in-platform-log-access-for-ontology-and-aip-workflows).

![Workflow Lineage showing the Edit permissions control in the Run history panel.](../../../assets/57cf11f5708699d0fca0b2bf36ee3bb6716fc3bef2e17658fdeaeb8156c6bae3.webp)

## Review log access requirements

The **Log access overview** dialog lists the three requirements a viewer must satisfy to see logs.

* **Role:** Shows your current role on the resource. If your role does not grant log access, the dialog suggests the least-privileged role that grants log access.
* **Log access policy:** Shows whether log access is enabled on the project containing this resource (and attributed project if the resource has been moved), enabled via a resource-level override, or not enabled. If you have the `Information security officer` or `Enrollment administrator` role, you can select **Edit** to configure the policy (see [Configure logging](../../administration/configure-logging/index.md#in-platform-log-access-for-ontology-and-aip-workflows)).
* **Log access markings:** Shows the markings applied to the logs and, if you are missing any, how many.

![Log access overview dialog showing the role, log access policy, and markings requirements.](../../../assets/c3dec366477ba9aa3cbd5cc1dc74be2356bc486daed06351b4099f1c4ca500c6.webp)

## Markings on log content

The markings that protect log content are configured explicitly by an administrator when log access is enabled. These are the only markings enforced when a user attempts to view logs.

Markings are not derived from the source executor's resource, its inputs, or any data the execution accessed. Administrators are responsible for selecting markings that reflect the maximum sensitivity of any data the workflow may touch, as the platform cannot determine the full set of data sources a workflow may reach in advance. Logs enabled without markings are visible to every user who satisfies the role and log access requirements described above.

## Related documentation

* [Configure logging](../../administration/configure-logging/index.md#in-platform-log-access-for-ontology-and-aip-workflows): Enable and manage in-platform log access
* [Execution history](../run-history/index.md): View available executions
* [Service logs](../service-logs-and-debugging/index.md): Access logs once permissions are configured
* [Log search](../log-search/index.md): Search logs across executable resources and executions in Workflow Lineage
* [AIP security and privacy](../../aip/aip-security/index.md): Learn about the AIP security model