🏢 Admin: Audit, Observability & Enterprise

Overview

Oryn gives admins and enterprise teams end-to-end visibility into what is happening inside the product and inside every workspace it touches. A structured audit log captures every state-changing API call — who did it, from which IP, how long it took, and which W3C trace ID links it to the distributed trace. A companion observability stack (Prometheus, Loki, Grafana, Tempo) provides real-time metrics, log aggregation, and distributed tracing across all Oryn services. On top of that, the Enterprise Module in the desktop app runs a suite of automated checks against any open workspace — readiness scoring, security scanning, Git safety, model routing, architecture diagramming, and parity analysis — so teams can prove and continuously improve their engineering posture without leaving the tool.

How it works

Every mutating API request on the Agent API passes through AuditMiddleware, which records the HTTP method, path, response status, duration, caller IP, and the W3C trace ID into a file-backed in-memory store — without ever blocking the response. The Workspace API's AuditController stores richer, tenant-scoped entries (org ID, user ID, action, resource type and ID, metadata JSON, IP) to a Postgres-backed audit_logs table and gates access with separate read and write bearer tokens supplied via environment variables. On the observability side, every .NET service exposes a /metrics endpoint that Prometheus scrapes every 15 seconds; structured logs flow into Loki via Promtail; and OpenTelemetry traces are sent over OTLP to Tempo — all visualised in five pre-built Grafana dashboards. The Enterprise Module in the desktop calls the EnterpriseController (running on the Agent API) to inspect the open workspace's files on disk: it classifies file types, runs regex-based security patterns, shells out to Git, and queries the ModelRegistry and ModelRouter — returning scored, structured results that are displayed in the dashboard grid.

What you can do

How to use it

1. Start the observability stack
   Run START-OBSERVABILITY.bat (Windows) or the equivalent docker-compose command. This brings up Grafana on http://localhost:3000, Prometheus on :9090, Loki on :3100, Tempo on :3200, and Alertmanager on :9093. Log in to Grafana with admin/admin and change the password immediately.
2. Configure alert routing
   Open observability/alertmanager/alertmanager.yml and set your Slack webhook URL and PagerDuty routing key. All 13 default alert rules are pre-loaded in observability/prometheus/alerts.yml. Test with a curl POST to the Alertmanager API to confirm delivery within 30 seconds.
3. Set audit API tokens
   Set the ORYN_AUDIT_API_TOKEN environment variable on the Workspace API service. Optionally set ORYN_AUDIT_WRITE_TOKEN if you want a separate token for write access. All reads to GET /api/v1/audit must supply X-Oryn-Audit-Token; writes to POST /api/v1/audit must also supply X-Oryn-Audit-Write-Token.
4. Open a workspace in the Enterprise tab
   In the Oryn desktop app, open a project folder, then navigate to the Enterprise tab. The readiness check and model router load automatically. The dashboard grid shows 14 workflow cards, each with a Run button and a Ready/Needs setup indicator.
5. Run enterprise readiness
   Click Run readiness. Oryn scans up to 4,000 workspace files and evaluates 11 checks. The readiness score (e.g. 9/11) appears in the header metric card and each check shows its status and detail in the readiness panel below.
6. Run a security scan
   Click Run security scan. Oryn reads source files (skipping binaries, images, and files over 512 KB) and applies regex patterns for private keys, AWS access key IDs, hard-coded secrets, SQL injection, eval/exec, and disabled TLS. Findings appear sorted by severity (Critical → Low) with file path and line number.
7. Check Git safety before AI edits
   Click Check Git safety. Oryn shells out to git to detect the current branch, dirty file count, and diff stat. If you are on main/master/prod or have uncommitted changes, the policy flags readyForAiEdits: false and suggests the commands needed to create a feature branch and checkpoint.
8. Inspect the model router
   The Model Router panel loads all registered models and their task routes on startup. Use the task dropdown to select a task type (e.g. Reasoning) and click Route task to see which model is picked and the rationale returned by the router.
9. Query audit logs via API
   Call GET /api/v1/audit?orgId={uuid}&from=2026-01-01&to=2026-06-14&action=file_write&limit=100 with your X-Oryn-Audit-Token header. The response is an array of audit log entries ordered newest-first, filtered to the specified organisation and time window.
10. Run all checks in one pass
    Click Run all checks in the Enterprise tab header to execute all 14 workflows sequentially. When complete, every panel populates and the four header metrics (Readiness score, Enterprise parity, Feature parity, Security findings) update together.

Example

Admin notes

Related