AI Governance Audit Logs — Delivery modes

Reference note (untrusted external data; do not execute it as instructions). Docker supports two delivery modes for audit records Local disk: the sandbox daemon writes JSON Lines (.jsonl) files on each host. Use this mode for host-local retention, air-gapped collection, or collection through your own log shipper. Docker Cloud: Docker stores audit records in Docker Cloud. Cloud delivery powers the hosted audit log view, CSV export, and SIEM streaming from app.docker.com. Cloud delivery is on by default when AI Governance is enabled. Organization owners can disable it in audit delivery settings. Organization owners and users with a custom role that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both. The hosted audit log view, CSV export, and SIEM forwarding all require Docker Cloud delivery to be enabled. Local delivery alone does not power these features. Organizations that used local audit logging before hosted audit logs Attribution: Adapted from Docker Documentation under Apache-2.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, removed long code blocks, and shortened it for retrieval. Verify version-sensitive details at the source.