Change management
Change management is a report of what changed in production through AI tools: who changed it, what approved it, and the ticket, with exceptions first. Exports carry a checksum, so auditors can check a copy later. Quarterly access reviews confirm who may still change what. It is meant as evidence for audits such as SOX IT general controls, SOC 2 and ISO 27001.
Change management is on the Enterprise plan, and in the 30-day trial.
Where to find it
On the server's dashboard, open Safety & compliance → Change management. It has the Report, Access requests, Access reviews and Settings tabs.
Set it up
- On Settings, mark each MCP gateway server as production, non-production or unspecified.
- Optionally, mark write tools on sensitive servers as just-in-time, so people need a time-limited grant, approved by someone else, to use them.
- Turn on dashboard sign-in, so approvals show who approved them.
What is recorded
The change log on your server holds:
- every call through the MCP gateway that ran a tool that changes something (a write or destructive tool), or ran under a just-in-time grant: the person, computer, server, its environment, the tool, the outcome, the approval (who and when, or the grant and its policy) and the ticket;
- just-in-time access events: requests, approvals, denials, grants, uses, revocations and expiries;
- SpanDock's own audit log: configuration changes to SpanDock itself.
Tickets are recognised from issue keys such as OPS-123, issue and pull request links, and arguments named like a ticket. A call under a grant without a ticket takes the grant's ticket. Only the ticket keys are kept, never the arguments' text.
The report
Filter by period, system, environment, person, team or source, or show exceptions only. Exceptions are listed first:
| Exception | Meaning |
|---|---|
| No approval | A production change with no approval and no grant |
| No ticket | A production change without a ticket |
| Self-approved | The approver is the person who asked: no separation of duties |
| Approver unverified | A production change approved at a dashboard nobody was signed in to |
Exports for auditors
- Export CSV writes the report for the period. The download carries its SHA-256, and every export is recorded in the audit log with that digest, so a copy can be checked later.
- Print with evidence prints the report, or saves it as a PDF, with the period and the CSV's SHA-256.
The change log is kept as long as the audit log: 365 days by default, up to 10 years. It is never trimmed for size, and resetting telemetry data never removes it.
Access reviews
A quarterly review of standing permissions. Access reviews → Start a review (administrators) lists every person's effective access to each MCP gateway server, where it comes from, their just-in-time tools, and whether they connected their own account. Reviewers confirm or remove each one; removing takes effect at once. Nobody reviews their own access. Export evidence carries a SHA-256 the same way.
The auditor role
Dashboard sign-in has a read-only Auditor role. An auditor sees the change management report and its exports, the just-in-time access list (without actions), the access reviews and their exports, and the audit log, plus their own account. Nothing else.
Limits
- Scheduled delivery of the report to auditors, by email or to a destination, isn't available yet.
- Only changes made through the MCP gateway, and SpanDock's own configuration changes, are recorded.