rjgoyln opened a new pull request, #72247: URL: https://github.com/apache/airflow/pull/72247
## Summary Under the FAB auth manager only `Admin` can read the audit log, so the events a Dag's own users need in order to debug it — a task killed by the executor, a heartbeat that timed out — are out of their reach. Audit access was narrowed to `Admin` in #37501 because the audit log mixed Dag-scoped rows together with Connection, Variable and Pool operations, which carry no per-Dag key to authorize on. #70759 separated the two in Airflow 3.4.0: those rows now sit behind `All Audit Logs`, leaving `Audit Logs.can_read` covering only the Dag-scoped rows, which both event log endpoints already narrow to the Dags the caller may read. ## Compatibility The grant follows that split rather than the provider version: a core without `AccessView.AUDIT_LOGS_ALL` still returns the Dag-less rows to anyone holding `Audit Logs.can_read`, so both permissions stay with `Admin` there. closes: #72238 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Opus 5 (1M context) Generated-by: Claude Opus 5 (1M context) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
