docs: Wave 2b fixes (B4 alerts/reports, B6 engines, B7 auth/roles; KI-260 onwards)

platform/control-plane/access-control/index.md

@@ -39,7 +39,7 @@ Findings about the way access is set up. Each has a title, a sentence and a **Re
 
 ### Recent changes
 
-The latest audit entries with the action (for example `perm_grant:create`), the resource type, the actor and the time. The actor is shown as a short user id (`by 8a66d837`), not a name. **View audit log** opens the full [Audit log](../audit-log.md).
+The latest audit entries with the action (for example `perm_grant:create`), the resource type, the actor and the time. The actor is shown by email (`by admin@egret.local`), or by a short user id when the account no longer exists. **View audit log** opens the full [Audit log](../audit-log.md).
 
 ### How access works
 

platform/control-plane/access-control/users.md

@@ -24,7 +24,7 @@ A summary strip counts **users**, **active** and **disabled**. Two filters narro
 | **User** | Avatar, display name and email. |
 | **Provider** | `local` for accounts created in egret, `oidc` for people who sign in through SSO. |
 | **Status** | **active** or **disabled**. A disabled user cannot sign in. |
-| **Roles** | Platform roles the user holds, or a dash. |
+| **Roles** | Platform roles granted to the user directly, or a dash. A role the user holds through a group is not shown (KI-260). |
 | **Groups** | How many groups the user belongs to. |
 
 The **⋯** menu on a row offers **View access** (the [Access Explorer](./access-explorer.md) for that person), **Assign roles**, **Edit**, **Impersonate** and **Delete**.
@@ -45,7 +45,7 @@ Prefer SSO for people. A local account has its own password and does not follow
 
 ## Bulk select
 
-**Bulk select** adds checkboxes. After you tick users, a bar shows *N selected* with **Disable**, **Enable**, **Assign role…** and **Clear**. **Done** leaves bulk mode.
+**Bulk select** adds checkboxes. After you tick users, a bar shows *N selected* with **Disable**, **Enable**, **Assign role…** and **Clear**. **Done** leaves bulk mode. Bulk **Disable** acts at once, without the confirmation the user page asks for; the toast that reports it offers **Undo** (KI-262).
 
 ![Bulk select with two users ticked and the actions bar](/img/platform/admin/cp-users-bulk.png)
 
@@ -61,7 +61,7 @@ Select a user to open their page. The header shows the avatar, name, status, pro
 
 ### Roles
 
-*Platform-wide roles this user holds. Workspace roles are assigned per workspace.*
+*Platform-wide roles this user holds. Workspace roles are assigned per workspace.* Only roles granted to the user directly are listed; roles granted to one of the user's groups are on the group's page.
 
 1. Under **Scope**, choose **Platform** or **Workspace**.
 2. For **Platform**, choose a **Role** (for example `data_steward` or `platform_admin`). For **Workspace**, pick the workspace first.
@@ -75,7 +75,7 @@ The table lists **Role** and **Scope** with a remove button. With none it reads
 
 ## Disable and delete
 
-**Disable** blocks sign-in without removing anything and signs the user out; it applies at once, without a confirmation. The status becomes **disabled** and **Enable** reverses it. **Delete** asks *Delete "\<email\>"?* (*This user, their sessions, group memberships, and role grants will be permanently removed. This cannot be undone.*) and needs you to type `delete`. Prefer disabling: grants and shares that name a deleted user become unmatched names (see [People & groups](../../data-governance/people-and-groups/index.md)).
+**Disable** blocks sign-in without removing anything and signs the user out. It asks first: *Disable \<email\>?* (*They are signed out at once and cannot sign in until the account is enabled again. Their memberships and role grants are kept.*), with **Cancel** and **Disable user**. The status becomes **disabled**. **Enable** reverses it at once, without a confirmation. **Delete** asks *Delete "\<email\>"?* (*This user, their sessions, group memberships, and role grants will be permanently removed. This cannot be undone.*) and needs you to type `delete`. Prefer disabling: grants and shares that name a deleted user become unmatched names (see [People & groups](../../data-governance/people-and-groups/index.md)).
 
 ## Limits and known issues
 

platform/control-plane/audit-log.md

@@ -6,6 +6,8 @@ sidebar_position: 7
 
 The **audit log** is the append-only record of authorization decisions and changes on the platform: who did what, to which object, and whether it was allowed. **Control Plane → System → Audit log** reads it, newest first. It is visible to platform admins only.
 
+The page opens on **Changes and denials**: every recorded change and every refused request, without the allowed decisions that each page view writes. Choose **All** under **Kind** to see those too.
+
 ![The Audit log with its filters and rows](/img/platform/admin/cp-audit-log.png)
 
 ## Read the log
@@ -15,7 +17,7 @@ The page shows a table with six columns:
 | Column | Meaning |
 |---|---|
 | **Time** | When it happened, relative. |
-| **Actor** | The user's email, or a short id for an account the page cannot resolve (for example a service account). |
+| **Actor** | The user's email, or a short id for an actor that is not a user who still exists (for example a deleted account or a service account). |
 | **Action** | What was attempted, in the form `thing:action`, for example `secret:read`, `member:add`, `perm_rule:create`. |
 | **Resource** | What it was about: the resource type and id, for example `workspace (e76a8865-…)` or `platform`. |
 | **Decision** | **allow** or **deny** for an authorization decision, a dash for a recorded change. |
@@ -30,20 +32,20 @@ Every page loads 100 rows. **Load more** fetches the next 100 using a keyset cur
 | **Decision** | An authorization check: the actor asked to do something and the policy engine answered. | **allow** or **deny**, with the grants that decided. | `secret:read` on `platform`, **allow**, `grant-0` |
 | **Mutation** | A change that was made. | A dash. | `member:add`, `object_grant:put`, `perm_rule:create`, `tag:assign` |
 
-Decisions are recorded for the platform's role-based checks. Impersonation is recorded as the mutations `impersonation.start` (with the reason) and `impersonation.end`, with the admin as the actor; the decisions made while impersonating are recorded under the impersonated user, with nothing that names the admin. Governance changes also appear on the Governance overview's **Recent changes**; the audit log keeps the raw entries.
+Decisions are recorded for the platform's role-based checks. Impersonation is recorded as the mutations `impersonation.start` (with the reason) and `impersonation.end`, with the admin as the actor; the decisions made while impersonating are recorded under the impersonated user, with nothing that names the admin. Governance changes also appear on the Governance overview's **Recent changes**; the audit log keeps the raw entries. A workspace pre-registration is recorded as `member:invite` and `member:uninvite`, and its redemption at the person's first sign-in as `member:add` with the inviting admin as the actor and `"via": "pre-registration"` in the detail.
 
 ## Filter the log
 
 The filter bar sits above the table.
 
 | Filter | Options |
 |---|---|
-| **Kind** | **All**, **Decision**, **Mutation**. |
+| **Kind** | **Changes and denials** (the default: mutations and denied decisions), **All**, **Decision**, **Mutation**. |
 | **Decision** | **All**, **Allow**, **Deny**. |
 | **Action** | An exact action, for example `secret:read`. A partial word such as `secret` matches nothing. |
 | **From** and **To** | A date and time range (your browser's local time). |
 
-The same filters work in the API: `GET /api/control-plane/audit` accepts `kind`, `decision`, `action`, `actor`, `workspace`, `from`, `to`, `cursor` and `limit`.
+The same filters work in the API: `GET /api/control-plane/audit` accepts `kind`, `decision`, `hideAllowed`, `action`, `actor`, `workspace`, `from`, `to`, `cursor` and `limit`. `hideAllowed=true` is what **Changes and denials** sends. Each entry carries `actorEmail` next to `actorUserId`.
 
 ### Find out who did something