ai: update audit logs (#25679)

<!--Delete sections as needed -->

## Description

Updated audit logs. 

## Related issues or tickets

<!-- Related issues, pull requests, or Jira tickets -->

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Technical review
- [ ] Editorial review
- [ ] Product review

---------

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>

Author: craig-osterhout

content/manuals/ai/sandboxes/faq.md

@@ -13,7 +13,7 @@ Docker account, and run sandboxes at no cost.
 
 The only paid component is organization governance: centrally managed network
 and filesystem policies, [sign-in enforcement](governance/sign-in-enforcement.md),
-and [audit logs](governance/audit.md). These
+and [audit logs](governance/audit/). These
 [organization governance features](governance/) require a separate paid
 subscription —
 [contact Docker Sales](https://www.docker.com/products/ai-governance/#contact-sales)

content/manuals/ai/sandboxes/governance/_index.md

@@ -9,15 +9,16 @@ Sandbox governance covers the policy system that controls what sandboxes can
 access over the network and on the filesystem. It operates at two layers, and
 only one applies at a time:
 
-**Local policy** is configured per machine using the `sbx policy` CLI. It
-lets individual developers customize which domains their sandboxes can reach.
-See [Local policy](local.md).
+**Local policy** is configured per machine using the `sbx policy` CLI. It lets
+individual developers customize which domains their sandboxes can reach. See
+[Local policy](local.md).
 
-**Organization policy** is configured centrally in Docker Home or
-via the [Governance API](/reference/api/ai-governance/). Rules defined at the org level apply
-uniformly across every sandbox in the organization. When organization
-governance is active, it replaces local policy entirely: local `sbx policy`
-rules are no longer evaluated. See [Organization policy](org.md).
+**Organization policy** is configured centrally in the Docker Admin Console or
+via the [Governance API](/reference/api/ai-governance/). Rules defined at the
+org level apply uniformly across every sandbox in the organization. When
+organization governance is active, it replaces local policy entirely: local
+`sbx policy` rules are no longer evaluated. See
+[Organization policy](org.md).
 
 Alongside this access-control policy, admins can require developers to sign in
 as members of their organization before using sandboxes at all.
@@ -32,17 +33,17 @@ personal account.
 
 ## Learn more
 
-- [Policy concepts](concepts.md): resource model, rule syntax, evaluation,
-  and precedence
+- [Policy concepts](concepts.md): resource model, rule syntax, evaluation, and
+  precedence
 - [Local policy](local.md): configure network and filesystem rules on your
   machine with the `sbx policy` CLI
-- [Organization policy](org.md): centrally manage sandbox policies across
-  your organization
+- [Organization policy](org.md): centrally manage sandbox policies across your
+  organization from the Admin Console
 - [Sign-in enforcement](sign-in-enforcement.md): require developers to sign in
   as organization members, enforced through endpoint management
-- [Monitoring](monitoring.md): inspect active rules and monitor sandbox
-  network traffic with `sbx policy ls` and `sbx policy log`
-- [Audit logs](audit.md): capture a durable, structured record of every
-  policy decision for SIEM ingestion and compliance
+- [Monitoring](monitoring.md): inspect active rules and monitor sandbox network
+  traffic with `sbx policy ls` and `sbx policy log`
+- [Audit logs](audit/): view, configure, export, and collect governance audit
+  records
 - [API reference](/reference/api/ai-governance/): manage org policies
   programmatically via the Governance API

content/manuals/ai/sandboxes/governance/audit.md

@@ -0,0 +1,78 @@
+---
+title: AI Governance Audit Logs
+linkTitle: Audit logs
+weight: 28
+description: Capture, view, export, and collect structured audit records for Docker AI Governance policy decisions.
+keywords: docker sandboxes, audit log, audit logging, AI Governance, policy decision, SIEM, compliance, jsonl
+---
+
+AI Governance Audit Logs record Docker AI Governance activity for your
+organization. Each record captures the principal, action, target, decision, and
+time for a governance event. Records contain metadata only. They don't contain
+prompt content, agent output, or parameter values.
+
+Audit logs are exposed when AI Governance is enabled for your organization.
+Docker Sandboxes send audit records only for signed-in users who have an AI
+Governance license and are governed by an enforced centralized [organization
+policy](../org.md). Docker Sandboxes users without both don't send audit data to
+audit logs.
+
+> [!NOTE]
+> AI Governance Audit Logs are part of Docker AI Governance and require a
+> separate paid subscription.
+> [Contact Docker Sales](https://www.docker.com/products/ai-governance/#contact-sales)
+> to request access.
+
+## Requirements
+
+To use AI Governance Audit Logs, your organization needs:
+
+- A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md)
+- An enforced organization governance policy
+- A Docker organization account
+- An organization owner, or a user with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that includes AI Governance audit permissions, to configure delivery and view hosted events
+
+> [!NOTE]
+> Other Docker subscriptions are not sufficient on their own to use AI Governance
+> Audit Logs. Users without an AI Governance license and an enforced organization
+> policy will not generate audit data and will not appear in audit events or SIEM
+> forwarding output. Personal accounts are not supported.
+
+## Coverage
+
+AI Governance Audit Logs cover Docker Sandboxes policy decisions and sandbox
+session events. Other Docker AI sources can emit records through the same schema
+as they become available.
+
+## Delivery modes
+
+Docker supports two delivery modes for audit records:
+
+- **Local disk**: the sandbox daemon writes JSON Lines (`.jsonl`)
+  files on each host. Use this mode for host-local retention, air-gapped
+  collection, or collection through your own log shipper.
+- **Docker Cloud**: Docker stores audit records in Docker Cloud. Cloud
+  delivery powers the hosted audit log view, CSV export, and SIEM streaming from
+  app.docker.com. Cloud delivery is on by default when AI Governance is enabled.
+  Organization owners can disable it in [audit delivery settings](configure.md).
+
+Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that includes AI Governance audit permissions can configure local disk, Docker Cloud, or both.
+
+Organizations that used local audit logging before hosted audit logs were
+available start with cloud delivery off until an owner opts in from
+[audit delivery settings](configure.md).
+
+## Data handling
+
+When Docker Cloud delivery is enabled, Docker stores audit records in Docker
+Cloud for the retention window configured by your organization. For legal and
+privacy terms that govern Docker services, see Docker's [Terms of
+Service](https://www.docker.com/legal/docker-terms-service/) and [Privacy
+Policy](https://www.docker.com/legal/privacy/).
+
+## Learn more
+
+- [Local audit logs](local.md)
+- [Configure audit delivery](configure.md)
+- [View and export audit events](view-export.md)
+- [Audit record reference](record-reference.md)

content/manuals/ai/sandboxes/governance/audit/_index.md

@@ -0,0 +1,73 @@
+---
+title: Configure audit delivery
+linkTitle: Configure delivery
+weight: 20
+description: Configure local and cloud delivery, retention, and history for Docker AI Governance Audit Logs.
+keywords: docker sandboxes, audit delivery, AI Governance, audit logs, retention, cloud delivery, AI Platform
+---
+
+Organization owners and users with a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) that includes AI Governance audit permissions can configure where Docker writes audit events.
+Two delivery destinations are available and can be used independently or
+together:
+
+- **Local disk**: The sandbox daemon writes audit events to the local disk
+  on each host.
+- **Docker Cloud**: Audit events are sent to Docker's cloud platform, enabling
+  the hosted log view, CSV export, and SIEM forwarding.
+
+## Before you begin
+
+Your organization needs:
+
+- A Docker [AI Governance plan](/manuals/subscription/plans/ai-governance.md)
+- An enforced organization governance policy
+- Organization owner access, or a [custom role](/manuals/enterprise/security/roles-and-permissions/custom-roles.md) with AI Governance audit permissions
+
+Only users who have an AI Governance license and are governed by the enforced
+organization policy send Docker Sandboxes audit data.
+
+## Configure delivery
+
+To configure audit delivery:
+
+1. Sign in to [Docker Home](https://app.docker.com/).
+2. Open your organization.
+3. Go to **AI Platform** > **Audit logs**.
+4. Open **Audit Delivery**.
+5. Choose one or both delivery modes:
+   - **Local disk** writes audit records to JSON Lines files on each host.
+   - **Docker Cloud** stores audit records in Docker Cloud for hosted search,
+     CSV export, and SIEM forwarding.
+6. Save your changes.
+
+Cloud delivery is on by default when AI Governance is enabled. To keep records
+local to your hosts, turn off **Docker Cloud** and keep **Local disk** on.
+
+Organizations that used local audit logging before hosted audit logs were
+available start with cloud delivery off until an owner opts in.
+
+## Configure retention
+
+When **Docker Cloud** is selected, you can also configure how long cloud-stored
+events are retained:
+
+| Field                          | Description                                                        | Default |
+| ------------------------------ | ------------------------------------------------------------------ | ------- |
+| Searchable retention (days)    | How long events stay searchable in the hosted audit log view.      | 90 days |
+| Archive retention (days)       | How long events are kept in long-term archive storage.             | 90 days |
+
+Archive retention must be greater than or equal to searchable retention.
+
+Retention reductions apply going forward. They don't delete records that were
+already retained under a longer retention window.
+
+## Audit delivery change history
+
+Docker keeps a record of every change made to your organization's audit delivery
+settings. Each entry captures the timestamp, the user who made the change, and
+the delivery configuration that was set. Use this history to audit configuration
+changes and verify when delivery modes or retention windows were modified.
+
+Open **History** to review delivery and retention changes for your organization.
+History entries show who made the change, when it happened, and the before and
+after values.