Every active tag, exclusion, snooze and note across the fleet. This is where you bring an excluded device back into the counts, end a snooze early, or clean up tags. Removals take effect on the next data refresh.

Every human change and security-relevant event: annotation edits, user/group changes, vendor edits, exports, break-glass logins, token activity. Machine-written rows (sync results, snapshots) are deliberately not logged.

Shared and automation accounts, flagged by hand. They are excluded from onboarding baselines and can be whitelisted from waste. Flag an account from a person's profile or in the admin.