Trash, Undo and the Audit Log

Undo

Cmd+Z, immediately after the action. Cmd+Shift+Z redoes.

This is server-backed rather than a browser convenience, and it is shared with the AI agent's undo tools — so an agent action can be reversed the same way, and 'undo that' is a valid instruction to the agent.

It covers trash-style lifecycle changes to tasks, projects and clients. Reach for it in the moments right after something went wrong, when you still know exactly what happened.

Trash

Settings → Trash holds recently deleted tasks, projects, clients and members.

Restore individually, or permanently delete when you are sure.

This is the mechanism for 'I deleted that last week', where undo is long past. It is also the mechanism to check before concluding something is gone — the reflex of assuming a deletion is permanent produces a lot of unnecessary reconstruction.

The practical advice from Lesson 2.1 applies here in reverse: prefer archiving to deleting in the first place, so trash is a safety net rather than a working surface.

The audit log

Settings → Audit Logs is the durable record of what happened in the workspace: who did what, when, including actions the AI agent took.

This does not restore anything. It answers the question that comes first: what actually happened?

Use it when the situation is confusing rather than simply wrong — when a value is not what anyone expected and nobody remembers changing it, when work has moved and nobody claims responsibility, when you need to know whether an action was ever attempted at all.

It is also the surface that makes agent autonomy widening defensible. Two weeks of agent actions, readable, is what turns 'should we let it do more' from a feeling into a review.

Audit Logs is only the first of nine tabs on that panel, and the rest are easy to never notice. Retention sets how long records are kept. Event Config chooses what gets recorded in the first place. Alert Rules and Webhooks push events outward as they happen, rather than waiting for someone to come and read. eDiscovery and Legal Holds are the litigation surfaces — search across the record, and freeze it so retention cannot age it out. Compliance and Data Access are the reporting side, including who has looked at what.

Most teams need none of these on day one. The two worth setting early are Retention, because it silently governs whether the record you want will still exist, and Event Config, because an event nobody recorded cannot be recovered later by any of the other eight.

What nothing covers

The more useful half of this lesson.

Anything that has left the building. A sent email is sent. A posted message in an external system is posted. A triggered deployment has deployed. There is no undo, no trash, and the audit log will tell you it happened but not take it back.

A permanently deleted item from trash. That is what permanent means.

And the danger-zone operations, which are separated in Settings precisely because none of the mechanisms above apply to them.

This is exactly why the action-policy defaults park external sends and destructive actions for approval, and why keeping those categories on approve is a reasonable permanent end state. The approval step is not a training-wheels phase for those categories — it is the only control that exists.

A recovery habit

Two things worth doing before you need them.

Use undo once, deliberately, on something disposable, so you know what it feels like.

And open the audit log once, so you know where it is and what it looks like. Both take under a minute, and both are much harder to do calmly for the first time in the middle of an incident.