Skip to content
WP Visibility

Review and control

See What the Assistant Did

Every ability call is logged with the user, the client's label, the target and the outcome, in a hash-chained table you can verify. Direct WordPress edits are outside it.

Updated September 21, 2026

Docs

Open WP Visibility → Review queue and select the Activity log tab. Calls are listed newest first, and the top of the tab reports the latest verification of the log’s hash chain. To check the chain from the command line:

wp visibility agent verify-log

which prints Audit log verified: 1,240 row(s), hash chain intact. or names the first row that does not match.

What a row contains

The time, the WordPress user, the client label (the Application Password’s name), the ability called, its target, a shortened excerpt of the input with license values redacted, the outcome, and how long it took. Reads are logged as well as writes, so the tab is a record of what the assistant looked at, not only what it changed.

The client label is what makes one password per client worth the minute it costs: two assistants connected as the same user are told apart here by nothing else.

What the chain proves

Each row stores a hash of the row before it. Verification walks the table and confirms every link. A break means rows were altered or removed after they were written. It does not prove the history is complete, and it cannot protect the table from someone who can rewrite the database and recompute the hashes; it is a tamper signal, not a vault.

What is not in it

Only calls through the plugin’s ability surface are recorded. A change made through the WordPress editor, the core REST API, WP-CLI, or another plugin, by the same user, does not appear. If an assistant’s credential has an administrator role, it can reach those routes, and this log will not show it. The user’s role decides what an assistant can reach; the log shows what it reached through the plugin.

Retention

Viewing the log runs housekeeping: entries older than 90 days go, and the oldest entries above 10,000 rows go. Export anything you need to keep before then.

From the command line and from an assistant

wp visibility agent log prints recent rows. The get-agent-log ability returns the same rows with chain information, so an assistant can be asked to summarize its own recent activity; the log is the source, the assistant’s summary is not.