TL;DR: As soon as a store has more than one person and a few installed apps touching it, "who changed this?" becomes unanswerable. Native activity logs are shallow, capped, and blind to whether a human or an app made the change. PainHunt's Commerce cluster wants a forensic audit trail over their store admin — attribution and retention the platform does not provide.
The evidence
E-commerce Operations surfaces in PainHunt with average score 11.5/15 and intensity 7.5/10, and the high-signal posts arrive overwhelmingly through Discourse — operators talking to other operators, not app-store venting.
The audit-trail complaint is described with legal specificity. An operator cannot identify which staff account deleted or updated product variants. The built-in activity log is limited to a few hundred results per report — one operator names 250 — which is useless for forensic analysis or any long-term audit need. The stakes are concrete: one is trying to assemble legal evidence of malicious activity by a former marketing agency before terminating them, and cannot. Platform support cannot retrieve all the historical data, and cannot say for certain whether a given change came from a user, an installed app, or a CSV upload. There is no clean attribution between third-party apps and human users in the admin at all.
The requested features are an operator's wish list for accountability: an audit trail with unlimited retention and full historical search; user-level attribution for every admin action, including app-initiated ones; exportable reports with timestamps, user IDs, IP addresses, and action detail; and real-time alerts on sensitive actions like bulk deletions or settings changes.
Why now
E-commerce admin surfaces got crowded. A modern store is not one owner clicking around; it is several staff accounts, a dozen installed apps with write access, scheduled imports, and automation flows — all mutating the same catalog and settings. The number of hands on the admin rose sharply while the platforms' native logging stayed a lightweight afterthought built for a single-operator store.
At the same time the consequences got real. Stores now carry enough revenue and enough staff turnover that a malicious or careless change is a financial and sometimes legal event, not a shrug. Agencies get hired and fired with admin access in between. And the shift toward app-driven automation means many changes have no human behind them at all — which the native log has no vocabulary to express.
So the write surface multiplied, the actors include apps that logs cannot attribute, and the operator's exposure became legal — while the tooling to answer "who did this" stayed where it was a decade ago.
The wedge
Do not rebuild the store admin. Be the black box recorder bolted to it.
- Capture every admin mutation through the platform's own events and API, and attribute each one to a specific actor — staff user, named app, or import — with a timestamp and, where available, an IP.
- Retain it beyond the native cap and make it fully searchable, so "what did this agency touch in March" is a query, not a support ticket.
- Alert in real time on the sensitive actions operators fear most: bulk deletions, price changes, permission changes, app installs with broad scope.
Start on one platform where the admin is genuinely multi-actor and the native log is genuinely thin, and be the tool a merchant reaches for the day something disappears and nobody will admit to it.
Risks and honest caveats
- You can only record what the platform exposes. If its event stream omits an action or blurs an actor, your trail inherits that blind spot. The product must be honest about coverage rather than implying a completeness the API cannot deliver.
- App-versus-human attribution is the hard part and the whole point. If you cannot reliably distinguish an app's write from a person's, you are just a prettier version of the log that already failed them. Nail attribution or do not ship.
- Audit data is sensitive data. You are storing a detailed record of everything that happens inside someone's business, including IPs and staff identities. A breach of that is worse than the problem you solve, so the security bar is the entry fee.
- This sells after an incident, not before. Merchants buy audit trails once a change has already burned them. Reaching them earlier means education, and education is slow; price and position for the post-incident buyer while you build the earlier demand.
How to validate this further
Read the Commerce operator threads in the Pain Point Browser and pressure-test the attribution-first framing with the Idea Validator. Related: audit trails for messaging consent and admin account succession for SaaS.