| UI or UX | UI + UX - Governed audit evidence surface for security, compliance, forensic, and administrative review | UI + UX - Searchable and exportable record of system, user, or administrative events | UI + UX - Inspectable record of generated AI output, prompt context, model, sources, tools, user actions, versions, and downstream use | UI + UX - Durable snapshot browser for previous document, file, page, object, or configuration versions | UI + UX - Durable user-opened notification history and action drawer |
| UI guidance | Render audit logs as governed evidence records with audit ID, effective time, actor, actor type, action, protected object, result, source system, IP or session context, retention class, export status, and permission scope. | Render activity logs as evidence-oriented records with event time, actor, action, object, source system, scope, result, and technical context such as IP address or location when available. | Render AI output audit trail as an answer-level evidence record that connects prompt snapshot, response snapshot, model version, source snapshot, retrieved context, tool calls, safety events, user actions, approvals, edits, exports, and retention state. | Render version history as a durable snapshot browser with the current version, previous version list, author, timestamp, named version labels, autosaved version labels, changed summary, retention status, compare affordance, preview, and restore action. | Provide a persistent notification entry point, usually a bell or inbox control, with a count that represents new unseen notifications rather than every unread item forever. |
| UX guidance | Use audit log when the product must support security review, compliance obligations, forensic investigation, privileged-action review, or administrator accountability with retained evidence. | Use activity log when users need to investigate, audit, verify, or troubleshoot actions across accounts, objects, systems, settings, or security boundaries. | Use AI output audit trail when users must investigate, prove, review, dispute, export, or comply with how a generated AI output was created and used. | Make recovery consequences explicit: what becomes current after restore, what happens to current edits or drafts, whether a restored version creates a new version, which comments or metadata carry forward, and which older versions are hidden by retention or permissions. | Use a notification center when users receive enough asynchronous system or collaboration updates that they need a durable place to review, triage, and act later. |
| Good UI | A security audit log shows a role escalation with audit ID, UTC effective time, actor session, target account, old role, new role, source IP, retention class, legal-hold badge, and Export evidence action. | An organization audit log table shows timestamp, actor, action, target object, app, IP address, result, and a Details drawer with before and after fields. | A policy answer drawer shows prompt snapshot, model version, response ID, retrieved sources, tool calls, safety filter result, generated text, user edits, approval, copy, export, and retention window. | A document side panel marks v42 as Current, lists v41, v38 named Pre-launch copy, and v35 autosaved, and opens a compare preview before Restore this version. | A bell opens a drawer with Unread and All filters, showing comment mentions, approval requests, export results, and background-job failures in newest-first order. |
| Bad UI | SIEM streaming falls behind but the UI says the audit pipeline is healthy. | An export button downloads a different date range and timezone than the on-screen filtered log. | The audit trail shows only the final answer and loses the prompt, source snapshot, model version, and action history. | The current version disappears from context while browsing older versions. | Users ignore the center because duplicate low-value messages inflate the badge. |
| Good UX | An investigator filters privileged actions, opens one audit record, verifies the chain of custody, exports the exact scoped result set, and sees which fields are redacted by administrative-unit scope. | An admin filters to failed SSO events, expands one entry, copies the event ID, exports the filtered range, and sees that records older than 180 days require a different archive. | A support lead opens a disputed customer reply, sees the exact AI draft, prompt, source article versions, editor changes, approver, sent timestamp, and retention status, then exports the evidence bundle. | A designer names the last approved file version, compares it against the current version, confirms restore, and sees that the restore created v43 while keeping v42 available. | Opening the notification drawer clears the new-notification badge while unread items remain available for later triage. |
| Bad UX | SIEM streaming falls behind but the UI says the audit pipeline is healthy. | A user marks a notification read and the corresponding activity evidence disappears from the only log. | An audit view says AI used sources but links to the current source pages rather than the source versions available when the output was generated. | The current version disappears from context while browsing older versions. | Users mark all notifications read and lose the only record of an export job they still need to download. |
| Best fit | The product must support security investigations, compliance review, legal discovery, privileged-action review, or enterprise governance. | Users need to inspect recorded user, admin, system, security, or integration events. | A generated AI output can influence compliance, customer communication, security, legal, finance, operations, code, policy, or other high-trust work. | Users edit documents, files, pages, design files, records, configurations, or published content over time. | Users receive multiple asynchronous updates across objects, jobs, collaborators, approvals, or reminders. |
| Avoid when | Users only need recent collaboration updates or a lightweight activity feed. | The goal is only to show a readable milestone history for one case or process. | Users only need to read the current answer and inspect citations in the moment. | The task is only immediate recovery from one recent action. | The product has only occasional current-action feedback that a toast or inline status can handle. |
| Required state | Default audit-log search state with visible query, result count, scope, timezone, retention class, and evidence coverage. | Default log state with event records, result count, visible timezone, retention window, and permission scope. | Generated output state with response ID, timestamp, user, conversation or thread ID, and model version. | Default state with current version, previous version list, author, timestamp, and change summary. | Closed entry-point state with zero, new-unseen, and unread-but-seen counts. |
| Accessibility burden | Use table or structured record semantics so audit ID, actor, action, object, timestamp, result, scope, and retention are perceivable together. | Use table or structured list semantics so actor, action, object, timestamp, result, and scope are perceivable together. | Use tables, disclosure groups, or timelines with semantic headings for prompt, response, sources, tools, actions, approvals, and retention. | Use structured list, table, or tab semantics so version number, current status, author, timestamp, and label are read together. | Announce new notification arrival with status semantics when appropriate, but avoid interrupting users repeatedly for low-priority center items. |
| Common misuse | Omitting audit ID, actor type, effective time, result, scope, retention, or source system from the visible record. | Using vague activity labels that omit actor, action, object, timestamp, or result. | Linking to current sources instead of the source snapshot used when the answer was generated. | Using a timeline of milestones as a substitute for previewable or restorable versions. | Treating the badge count, unread count, and total notification count as one number. |