Access is tenant scoped. Every sign-in, tool call and infrastructure change is written to the immutable audit log.