Audit Trail & Undo

Every domain record keeps a complete history of changes, so you always know who changed what — and can roll it back.

Change history #

All domain models track full change history. Each saved change is recorded as a group you can review on the record.

One-click undo #

An admin can undo most recorded entries with a single action, reverting the record to its prior state.

Undo is available to agency admins. Undo rewrites a record from the history rather than from a form, and it will happily reverse someone else's work — so it sits with the people who answer for the account. Everyone else keeps their normal edit rights and can correct a record forward. If anyone else presses Undo — on the message shown after saving, for example — they see Unable to Undo and nothing changes.

If part of an entry can't be put back — a record has been changed again since, or was created and cannot be recovered after deletion — the entry's page doesn't offer Undo, and Undo on the message after saving shows Unable to Undo. Usually nothing has changed.

A very large entry is not reversed at all. An entry holding more than 1,000 recorded changes offers neither Undo nor Redo: its page reads "Undo and Redo are offered only for entries of up to 1,000 changes", and names how many that entry holds. An entry of exactly 1,000 is still offered. Most of what reaches that size is bulk work — marking more than 500 monthly statements paid in one run, which records two changes per statement; generating more than 1,000 statements in one run; restoring an event's removed participants in bulk. An undo is itself recorded, as an entry two changes larger than the one it reverses, so undoing an entry just under the limit produces one just over it. Ordinary form saves, single deletes and single restores are nowhere near it.

An undo — or a redo — can also stop partway, if a record changes while it is running. The entry is then left partly reversed, and its page may stop offering Undo or Redo. From the entry's own page you are told when this happens. From the message shown after saving, it reads Unable to Undo, so treat that message as "check the record" rather than as a promise that nothing was written.

Entries themselves cannot be edited or deleted by anyone. A history you can rewrite is not a history.

Deleted records #

Most records are kept behind the scenes when deleted, so they can be recovered. Some are not, among them monthly statements, compensation tiers and stat rows, and deleting one of those is permanent.