diff --git a/wwwroot/api/deploy_account.dspy b/wwwroot/api/deploy_account.dspy
index 2a75a29..651dd58 100644
--- a/wwwroot/api/deploy_account.dspy
+++ b/wwwroot/api/deploy_account.dspy
@@ -13,6 +13,13 @@ from pipeline_service.deploy_account import (
     run_in_sandbox, write_file, read_file, list_dir, sanitize_username,
 )
 from pipeline_service.work_env import run_in_work_env
+from app_audit.audit_service import audit_log
+
+client_ip = ''
+try:
+    client_ip = request.get('client_ip', '') or ''
+except Exception:
+    pass
 
 # 查当前用户 username（账号名 ag_<username>）
 username = user_id
@@ -29,6 +36,11 @@ if action == 'ensure':
     try:
         async with get_sor_context(request._run_ns, 'pipeline') as sor:
             r = await ensure_account(sor, user_id, username)
+            await audit_log(sor, user_id, username, 'account_create',
+                            target='ag_' + sanitize_username(username),
+                            detail='created=' + str(r.get('created', '?')),
+                            result='ok' if r.get('created') is not None else 'fail',
+                            client_ip=client_ip)
         return json.dumps({'ok': True, **r}, ensure_ascii=False)
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@@ -46,6 +58,10 @@ elif action == 'remove':
     try:
         async with get_sor_context(request._run_ns, 'pipeline') as sor:
             r = await remove_account(sor, account_name)
+            await audit_log(sor, user_id, username, 'account_remove',
+                            target=account_name, detail=str(r.get('error', '')),
+                            result='ok' if r.get('ok') else 'fail',
+                            client_ip=client_ip)
         return json.dumps(r, ensure_ascii=False)
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@@ -64,6 +80,10 @@ elif action == 'run':
             _u = await sor.sqlExe("SELECT orgid FROM users WHERE id=${u}$", {'u': user_id})
             _org = getattr(_u[0], 'orgid', '') if _u else ''
             r = await run_in_work_env(sor, account_name, user_id, _org, command, workdir, timeout, network)
+            await audit_log(sor, user_id, username, 'sandbox_run',
+                            target=account_name, detail=str(command)[:500],
+                            result='ok' if r.get('ok') else 'fail',
+                            client_ip=client_ip)
         return json.dumps({'ok': True, **r}, ensure_ascii=False)
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
diff --git a/wwwroot/api/work_env.dspy b/wwwroot/api/work_env.dspy
index 38c2f15..acba52e 100644
--- a/wwwroot/api/work_env.dspy
+++ b/wwwroot/api/work_env.dspy
@@ -92,6 +92,11 @@ elif action == 'ensure_remote_bwrap':
     }
     try:
         r = await ensure_remote_bwrap(remote_config)
+        async with get_sor_context(request._run_ns, 'pipeline') as sor:
+            await audit_log(sor, user_id, username, 'remote_bwrap',
+                            target=str(remote_config.get('remote_host', '')),
+                            detail='部署/校验远程沙箱',
+                            result='ok' if r.get('ok') else 'fail', client_ip=client_ip)
         return json.dumps(r, ensure_ascii=False)
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)
@@ -107,6 +112,10 @@ elif action == 'get_org_pubkey':
             return json.dumps({'ok': False, 'error': '只有平台管理员能获取机构公钥'}, ensure_ascii=False)
         _oid = (params_kw or {}).get('org_id', '') or org_id
         r = get_org_pubkey(_oid)
+        async with get_sor_context(request._run_ns, 'pipeline') as sor:
+            await audit_log(sor, user_id, username, 'org_key_gen',
+                            target='org:' + str(_oid), detail='获取/生成机构公钥',
+                            result='ok' if r.get('ok') else 'fail', client_ip=client_ip)
         return json.dumps(r, ensure_ascii=False)
     except Exception as e:
         return json.dumps({'ok': False, 'error': str(e)}, ensure_ascii=False)