A security tool should offer role-based access control with at least read-only, developer and admin levels, plus an audit log that records who did what and when, with export and retention you can set. Ask to see a real log entry and the full list of permissions during the trial.
Definitions
Role-based access control (RBAC) assigns permissions to roles, and roles to people, so you grant access by job rather than person by person. An audit log is an append-only record of actions taken in the tool: logins, setting changes, finding suppressions, token creation, exports.
A security tool deserves extra scrutiny here. It holds a list of your weaknesses, and its settings decide what gets blocked. Anyone who can change a policy can quietly weaken your controls.
Role questions
| Question | Why it matters |
|---|---|
| Which roles exist, and can we define custom ones? | Fit to your org, not the vendor's |
| Can access be scoped to a team or project? | Least privilege |
| Who can change policies and gates? | Prevents silent weakening |
| Who can suppress or accept a finding? | Needs separation from the person who introduced it |
| Can API tokens be scoped and expired? | Tokens are accounts too |
| Is admin rights usage itself logged? | Closes the loop |
Audit log questions
- Which events are captured? Ask for the full list, not "all key events".
- What does one entry contain: actor, action, target, time, source address, before and after values?
- Can entries be edited or deleted by an admin? They should not be.
- How long are they kept, and can you set retention?
- Can you export them or stream them to your own log store?
- Are suppression decisions logged with a reason and an expiry?
The last point is the one auditors raise most. A suppressed finding with no recorded reason looks like a hidden risk. See what auditors look for in access review evidence and how long to keep audit evidence.
A ten minute trial exercise
Create two test users with different roles. As the lower role, try to change a policy, create a token and export data. Each attempt should either succeed or fail as documented. Then, as admin, open the audit log and find all three attempts. If the failed ones are missing, ask why, because failed attempts are often more interesting than successful ones.
Take screenshots of the role list and one log entry. Those become evidence for your own vendor file.
Quick check
Is an audit log the same as an activity feed?
No. A feed is a convenience view. An audit log is a tamper-resistant record meant for investigation and compliance.
How long should security tool logs be kept?
Match your policy and framework needs. Ask the vendor for configurable retention and an export path so you can hold them longer yourself.
Safeguard includes policies, gates and guardrails and compliance and evidence automation among its GA capabilities. Try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
