Audit and Collaboration

Stib combines live coordination on cards with durable access and audit records. Comments and conversations explain the work; the audit log explains who changed important system state.

Comments, messages, and mentions

• Use the agent conversation for instructions that should reach the running agent.
• Use card comments for human discussion and review notes that should not be interpreted as agent input.
• Use mentions to draw another member's attention where the composer supports them.
• Attach files to the appropriate card or message instead of sharing an unrelated local path.
• Send credentials only through the masked secret action, never in a comment.

Pending agent messages are stored server-side for the card. Refreshing the client does not create a second independent queue.

Groups and ownership

Groups create lanes inside a column. Labels, assignees, reviewers, and saved views provide additional organization without moving a card to another project. Which fields are available depends on board, role, and licence configuration.

Project sharing gives direct roles; organization administration provides inherited access. See Projects & Organizations.

Audit log

Open the project audit page from project navigation, or the organization Audit section for organization-wide events.

Audit records can be filtered by text, actor type, action, and entity. Selecting an event opens its detail. Typical entities include cards, columns, boards, projects, groups, members, credentials, API keys, and agent sessions.

The audit log is not a replay of every token or terminal byte. It records important product actions with actor and metadata. Conversation and Git history remain the better source for the content of an agent run.

Audit webhooks and export

Organization settings can send audit events to a webhook with configured headers. Use a scoped receiver, HTTPS, signature/secret validation, and a retention policy. Test the webhook after any proxy or encryption-key change.

Exports and external log sinks serve different purposes: audit export is about product actions; server log export is operational diagnostics.

Incident review

For an unexpected change, correlate:

1. audit actor/action/entity and timestamp;
2. card history and human comments;
3. agent session messages and tool activity;
4. Git diff and commit history;
5. server logs and integration sync errors.

Avoid attributing a filesystem change solely from an audit card event when a script, terminal session, or external process could also edit the repository.

Next: Agents, Git Integration, and Authentication.