Returns meta-audit logs for a tenant: the reads performed BY this tenant's principals, when, and how much came back. Tenant admins can only view their own tenant; platform admins can view any tenant.

This operation selects the READER axis, not the subject axis. It returns the rows whose readerTenantId is this tenant: the reads this tenant's own principals performed, INCLUDING a platform operator's read performed inside an impersonation session of one of those principals. A platform operator who reads this tenant's trail WITHOUT impersonating carries their own tenant on the reader axis and this tenant only on subjectTenantId, so that read is not in this result. An empty result here is therefore NOT evidence that nobody at the provider read this trail. The subject axis has its own operation - getAllAccessLogs with subjectTenantId, on the platform plane - for the same reason getTopTenants and getTopSubjectTenants are separate operations rather than one operation with an axis parameter.

An impersonated read names the operating human. readerUsername is the account the read ran as; impersonatorUsername is the platform operator who performed it, and is who this tenant would escalate about. That disclosure is deliberate: it is what lets a customer see which human at the provider read their trail in the impersonated case this operation covers, and the tenant-facing admin audit plane already discloses the same thing.

impersonatorUserId is served as null on this plane, never as a value. The name carries the accountability; the operator's platform user identifier adds nothing a tenant administrator can act on and is an enumerable internal handle, so this plane serves the name alone. The KEY is present on every row - one record has one wire shape - and the platform operation (getAllAccessLogs) serves both.

The row SET is unchanged by all of this: the new members are columns on rows this token could already read, and no row becomes visible that was not visible before.