Common
Audit the admin plane itself
Because admin actions can touch any tenant's data, every meaningful admin action is written to its own audit log, separate from tenant-level activity.
How it works
- Admin-initiated changes are recorded as admin audit log entries
- Admin accounts can change their own password through a dedicated endpoint
- Access is via either a static admin API token or an admin-specific JWT issued at login
Good to know
- The admin audit log is the first place to check when tracing an unexpected change to tenant configuration